Auth: first-class apikey type and digest authentication #41

Why

API keys are the most common credential on the internet, and today the only way to make one a project default is the exec header=X-Api-Key prefix= workaround or writing the header in every request. Digest auth is in every comparison table (httpyac, Bruno, Hurl, curl) and apic has none.

What

apikey

# @auth apikey {{key}}                       # header X-Api-Key by default, no prefix
# @auth apikey {{key}} header=X-Auth-Token
# @auth apikey {{key}} query=api_key
# @auth apikey {{key}} header=Authorization prefix="Token "

• Default header X-Api-Key, no prefix. query= puts it in the URL (masked in output under --redact, and the header name is added to the always-masked list).
• Usable as auth.default in apic.yaml. describe shows auth: apikey (header X-Api-Key).
• apic curl maps to -H or a query parameter.

digest

# @auth digest {{user}} {{password}}

• RFC 7616: MD5, MD5-sess, SHA-256, SHA-256-sess, qop=auth (and auth-int for requests with a body), opaque, nonce counting within a run. Implemented in-tree from the RFC in the style of internal/auth/sigv4.go; no dependency.
• Handles the 401 challenge round trip transparently (one extra request), reported in -v and as "auth": "digest" in --json. Credentials never appear in output.
• apic curl maps to --digest --user.

Where

internal/auth/spec.go (types at 23-30), apply.go (40-62), new digest.go, internal/runner/runner.go (challenge retry), internal/runner/redact.go (header list), internal/curlexport/curl.go.

Docs

docs/auth.md (two new sections, curl export table), docs/cheatsheet.md, docs/comparison.md (auth row), docs/format.md (directive table).

Tests

internal/auth/auth_test.go: RFC 7616 example vectors for digest; apikey header/query/prefix forms; runner test with an httptest server issuing the challenge; redaction of the query form; curl export.