Scope: Centralize endpoint auth routes and chain matchers for reuse across SecurityConfig and OpenAPI mapping- default to bearer, use explicit public overrides, and add mapping tests.