docs(open-api): address review feedback on auth endpoint specs

[augmentcode]

Follow-up to #175, which was already merged, so the review feedback is addressed here.

Review comments

/authorize — required parameters vs. the PAR flow (authorize.yaml:97)
AuthorizeRequestParser.resolvePushedRequest requires only the outer client_id and then replaces the whole payload, so a valid /authorize?client_id=…&request_uri=… carries no redirect_uri. redirect_uri, response_type, scope and code_challenge are now required: false with the conditional requirement described, and AuthorizeRequest.required is reduced to [client_id].

/authorize — prompt (authorize.yaml:180)
The parser splits prompt on spaces and rejects only combinations containing none, so login consent is valid. The scalar enum is dropped in favour of a plain string plus a description of the accepted values.

client_secret_post modelled as a cookie (introspect.yaml:56, par.yaml:72, revoke.yaml:55, token.yaml:85)
extractCredentials reads client_secret_post only from the parsed form and never from a cookie, so the apiKey/cookie scheme made tooling send the secret to a location the endpoints ignore. The scheme is removed; the alternative is now an empty security requirement, with the form-field mechanism documented on the operation.

/token success response cache header (token.yaml:228)
TokenEndpointController builds the success response with Response.json(response.toJson) and adds Cache-Control: no-store only on the error path, so the Cache-Control header is removed from the Tokens response.

/introspect inactive response (introspect.yaml:140)
When JWT deserialization fails the controller returns the inactive 200 without either cache header. The Cache-Control and Pragma headers are now documented as absent in that case.

/logout 303 (logout.yaml:49, logout.yaml:77)
performLogout delegates to renderLogout, which always returns a 200 HTML signed-out page and embeds the post-logout URI for client-side navigation; it never sets Location. The 303 responses and the PostLogoutRedirect component are removed, the client-side navigation is described, and the Cache-Control / Referrer-Policy headers the page actually sets are documented.

Additional gaps

authorization_details (RFC 9396) was entirely undocumented. Added to /authorize (query parameter + schema), /par (form field), /token (per-grant-type field, plus the authorization_details member of the success response), /introspect (response member) and metadata (authorization_details_types_supported), matching AuthorizationDetail.parse, AuthorizationDetailResolver.resolve and OAuthTokenService.resolveTokenAuthorizationDetails. Added invalid_authorization_details to the error code enums/lists on /authorize, /par and /token.

Internal vs. public resource organisation was undocumented. ResourceUri.internalResourceId / ResourceResolver distinguish public resources (requestable directly by URI) from internal ones (resource://{resourceId}, only reachable through the edge service and requestable only alongside the resource://edge indicator). This is now explained on the resource parameter/field of /authorize, /par and /token, and on authorization_details.locations, which follows the same rule.

Validated with redocly/cli lint — no errors, and the same warning set as before the change (no-server-example.com, plus operation-2xx/4xx-response on the HTML/redirect endpoints).