test(server): add HttpApi auth exercise mode

[kitlangton]

Summary

• add --mode auth to the HttpApi exerciser
• add scenario auth policy metadata with protected/public/bypass DSL methods
• probe both Effect HttpApi and legacy Hono with OPENCODE_SERVER_PASSWORD=secret and assert protected routes reject missing credentials

Verification

• bun run script/httpapi-exercise.ts --mode auth --include global
• bun run script/httpapi-exercise.ts --mode auth
• bun run script/httpapi-exercise.ts --mode coverage --include global
• bun run script/httpapi-exercise.ts --mode parity --include global
• bunx prettier --write test/server/httpapi-exercise/*.ts
• bunx oxlint packages/opencode/script/httpapi-exercise.ts packages/opencode/test/server/httpapi-exercise/*.ts

Notes

• This PR is stacked on refactor(server): split HttpApi exercise harness #26385 and should be reviewed after the mechanical harness split.
• bun typecheck still fails on unrelated existing repo issues around @opentui/keymap and TUI/API type drift.