securityScheme awareness and config validation

Read the spec's `securitySchemes` and warn when the config's auth type does not match what an operation expects.

**Files:** `src/spec/parse.ts`, `src/config/load.ts`

**Acceptance criteria**
- Parser surfaces each operation's expected scheme.
- A mismatch prints a clear warning (not a hard failure).
- Test coverage.

Comment `/assign` to claim.
