fix(cli): authenticate endpoints whose spec security scheme was renamed by auth-schemes

[devin-ai-integration]

Description

Fixes the cli seed shard that has been red on main since #17346 (oauth-client-credentials-openapi:with-wire-tests, wire_get/wire_list 404 on a WireMock no-match). #17346 started emitting an Authorization matcher for oauth schemes, which exposed two real bugs — the generated Rust CLI sends no auth header at all for that fixture, and the matcher ignores the scheme's configured token header.

1. The CLI sent no credentials. RoutingAuthProvider maps the endpoint's declared security scheme names to registered bindings. The fixture's generators.yml renames the scheme (auth-schemes: CustomAuth) while the baked spec's operations still reference the spec-declared BearerAuth, so nothing matched and the request went out unauthenticated (only a tracing::warn!). Now, when none of an endpoint's required schemes are bound at all, it defers to the default AnyAuthProvider instead of dropping auth. A scheme that is bound but has no credentials keeps the existing unauthenticated path + friendly 401 message.

   let Some(requirement) = satisfiable else {
       if self.requirements_are_unbound(requirements) {
           if let Some(default) = &self.default { return default.apply(request, endpoint); }
       }
       return Ok(request);
   };

2. The stub required the wrong header. mock-utils hardcoded Authorization: { matches: "Bearer .+" } for every oauth scheme. The fixture pins token-header: token / token-prefix: "", so the correct matcher is token: .+. getOAuthTokenPlacement now reads tokenHeader/tokenPrefix, and the basic+bearer-like collision case only applies when the OAuth scheme really writes Authorization: Bearer.

Verified end to end against a local HTTP mock that the built plant-store binary went from sending no auth header to sending token: <access_token> after the token exchange.

Changes Made

• generators/cli/sdk/src/auth/compose.rs: RoutingAuthProvider falls back to its default provider for requirements whose schemes are entirely unbound (apply + has_credentials_for).
• packages/commons/mock-utils/src/index.ts: OAuth auth matchers honor the scheme's tokenHeader/tokenPrefix.
• Regenerated the cli seed outputs (vendored SDK copy + the oauth fixture's wire-test-cases.json).
• Changelog entry under generators/cli/changes/unreleased/.

Testing

• Unit tests added/updated — routing_unbound_requirement_falls_back_to_default (Rust) and an OAuth custom-token-header case in generators/cli/src/__test__/wireTests.test.ts.
• Manual testing completed — seed test --generator cli --fixture oauth-client-credentials-openapi fails on main and passes here; full seed test --generator cli reports only expected failures.

Link to Devin session: https://app.devin.ai/sessions/840354f6bab64356b882ed2c0f20294f

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring