Server smoke-test fixes: typed parameters, sequential JSON, undocumented success, external security schemes

[tanmaykm]

Fixes from the live server-path smoke test that #104 called for before tagging v1.0.0: generated servers ran as real processes serving the classic petstore (driven by both the new generated client and the unmodified openapi-generator 0.2 client on OpenAPI v0.2.8), a purpose-built gap-fixture spec, and the real JuliaHub Job Secrets REST API document. Three commits, one per finding.

1. Typed parameters failed on every request (cbadad4) — bug fix

Server-side, any parameter whose planned Julia type is a generated value struct (string enums above all) was decoded twice: the emitted _typed_scalar/_typed_array helpers construct the typed value, then _finish_parameter re-decoded it, validating the Julia struct itself against its raw JSON schema. Every request carrying such a parameter failed with 400 — petstore's GET /pet/findByStatus was dead on arrival. _finish_parameter now decodes from the encoded wire form.

The same commit fixes buffered sequential-JSON handling: ndjson/json-seq responses can be documented with an array schema covering the whole sequence (planned as a vector type) or with the schema of one record (planned as the item type — Kubernetes-watch style, which the streaming path already supports via _stream_plan). The emitted server response encoder and the buffered client decoder only handled the array form; both now discriminate on the planned type, mirroring _stream_plan.

2. Operations documenting no success response answered 500 (d3649b3) — behavior change

Classic petstore documents no 2xx at all for 7 of its 20 operations (only 4xx entries); generated servers 500'd at response-encoding time after the handler had already run. Per the OAS Responses Object text (identical in 3.0.4/3.1.1/3.2.0), such documents violate only a SHOULD, and response documentation is explicitly non-exhaustive — a server answering with an undocumented success code is spec-consistent (the generated client already tolerates undocumented 2xx). Now:

• serverplan emits a :missing_success_response warning per affected operation at planning time.
• The generated server answers a handler's nothing with an empty 200 — the status 0.2-lane clients assert. A typed return value still errors (no documented media to encode against); HTTP.Response passthrough remains for full control.

3. Dangling security-scheme references rejected real documents outright (469e897) — behavior change

The real JuliaHub secrets document names openId/bearerAuth in operation security while declaring no schemes — a common production shape where auth lives in a gateway. The loader failed in strict and permissive mode, making the document unprocessable (the 0.2 lane accepted it). The Security Requirement name rule is a hard MUST, so strict mode still rejects; but the specification's multi-document pattern explicitly endorses a referenced document naming schemes its entry document declares ("treated as an interface for referenced documents to access"). Under strict=false, :unknown_security_scheme is now a warning and the scheme is treated as externally declared: generation excludes it from operation security descriptors (the runtime cannot construct credentials for a scheme it cannot see), a requirement group naming only external schemes becomes an anonymous alternative, and callers supply gateway auth explicitly (e.g. request_headers).

Validation

• Full package test suite passes with all three commits.
• New regression coverage: externally-declared-scheme testset in test/semantics.jl (strict rejection, permissive warning, descriptor filtering); the parameter and sequential fixes are exercised by the existing suite plus the live smoke tiers below.
• Live smoke tiers (session harness, not committed): petstore same-lane 27/27; cross-lane with the unmodified 0.2 petstore client 25/25 (with fix(client): keep form-style CSV separators literal in query strings #107 on release-0.2); gap fixtures (oneOf unions, deepObject/pipeDelimited/enum/header/cookie params, security AND/OR, 204, passthrough, ndjson buffered+streamed) 19/19; the unmodified JuliaHub secrets document generated permissively, implemented, and driven end to end 21/21.

Closes out the server smoke-test item from #104.