Read JetBrains Security.Auth blocks from env files #43

Why

JetBrains HTTP Client stores OAuth2 configurations in http-client.env.json / http-client.private.env.json under "Security": {"Auth": {"<name>": {...}}} and references them in requests as {{$auth.token("<name>")}}. A team that already has that setup should be able to run the same files with apic without translating to # @auth oauth2 by hand.

What

• Parse Security.Auth.<name> for the selected environment: Type (OAuth2), Grant Type (Client Credentials, Password, Device Authorization, Authorization Code; Implicit is refused), Token URL, Auth URL, Client ID, Client Secret, Scope, Username, Password, Client Credentials (basic/in body), Custom Request Parameters.
• {{$auth.token("name")}} and {{$auth.idToken("name")}} resolve by running the mapped grant through the existing OAuth2 code and cache.
• apic env lists the auth configs by name (secrets masked); describe shows which one a request uses.
• Unknown keys are warnings from validate, not errors.

Where

internal/env/env.go, internal/runner/vars.go (new $auth built-in), internal/auth/spec.go (mapping), internal/cli/inspect.go (env).

Docs

docs/auth.md (new "JetBrains projects" section), docs/format.md (env file section), docs/comparison.md.

Tests

Env parsing of a JetBrains-shaped file; mapping to a spec for each grant; $auth.token resolution against an httptest token endpoint; masking in env output.