DocumentModel gains securitySchemes (parsed from components.securitySchemes)
and servers (absolute URLs from the top-level servers[] array), and Endpoint
gains a resolved security requirement list (operation-level overrides global,
including an explicit [] meaning "no auth"). Powers docfy-ui's "Try it out"
auth UI and its same-origin proxy allowlist.