Run the conformance gate against auth-api

[ExtraToast]

What to build

auth-api runs the conformance gate: its running application is fuzzed against its own spec on every pull request, reads only.

This is the first adoption, so it also proves the reusable workflow works against a real service with real authentication before the other two follow.

Acceptance criteria

• Read-only operations are fuzzed on every pull request and the gate joins the pipeline aggregator
• The fuzzer authenticates as a seeded test identity rather than bypassing auth
• The scheduled full run covers mutations
• Confirmed to fail against a deliberately non-conforming build before being trusted

Blocked by

• Reusable Schemathesis conformance workflow
• Adopt the ProblemDetail customizer, re-export the spec, republish clients