Allow composing multiple auth requirements on one operation

An operation declares exactly one requirement today — `auth.Required()`, `RequireRole`, or `RequirePermission`. There is no way to express "an admin, or anyone holding `billing:write`", which is a shape real applications reach for quickly. The auth design deferred it (`docs/superpowers/specs/2026-08-31-auth-foundation-provider-abstraction-design.md`, *Deferred*).

The open questions are whether OR is enough or AND is also wanted, and how a composed rule renders in the OpenAPI security field, since `Operation.Security` is what makes enforcement and the published contract unable to disagree.

Came out of reviewing the deferred sections of the existing specs.

Start with the Deferred section in docs/superpowers/specs/2026-08-31-auth-foundation-provider-abstraction-design.md and inspect how operations currently use auth requirements and Operation.Security. Resolve whether composition supports OR alone or also AND, then define matching enforcement and OpenAPI security behavior so the implementation and published contract agree.

Written by the indexing model from the issue text.