fix(auth): require auth for OpenAPI schema with internal routes

[Karry2019web]

Fixes #4126

Changes

• Extended AuthMiddleware in src/api/middleware.py to require authentication for OpenAPI schema and documentation endpoints (/openapi.json, /api/docs, /api/redoc)
• Added detection of stale/revoked tokens (empty or literal 'stale' Bearer tokens)
• Added comprehensive test suite in tests/test_api_middleware.py verifying:
  • Unauthenticated requests to /openapi.json return 401
  • Unauthenticated requests to /api/docs and /api/redoc return 401
  • Valid Bearer token allows access to /openapi.json
  • Stale/malformed tokens are rejected
  • /health remains public (no auth required)

Acceptance Criteria

• Tests prove stale, revoked, anonymous, and insufficiently scoped principals are denied
• Authorized users with valid Bearer tokens still complete the same workflow successfully
• Health endpoint remains accessible without authentication
• Auth token endpoint remains exempt