fix: honor optional request bodies

[kriptoburak]

Summary

• Add an OpenAPI 3.1 security fixture based on Xquik's public searchTweets contract.
• Verify a registered apiKey handler authorizes the canonical x-api-key header.
• Honor requestBody.required instead of inferring required bodies from media-type count.
• Add regression coverage for omitted optional request bodies.

The request-body fix also resolves #817 and its earlier duplicate #292.

Validation

• npm ci
• NODE_ENV=test jest --runInBand (294 tests)
• npm run build
• npm run lint
• npx prettier --check src/validation.ts src/validation.test.ts src/backend.test.ts
• git diff --check