Flask: plugins (JWT/API-key auth), enable_cors, publish_swagger, openapi_insecure

[thorwhalen]

Fixes #42 (the auth/CORS/swagger part; the leftovers from the #43 review are now #44).

• JWTPlugin / ApiKeyAuthPlugin gain a framework-independent authenticate(header, *, method, endpoint) (reusing py2http.auth); the Bottle plugins now call it, behaviour unchanged.
• New py2http/flask_plugins.py: before_request auth hook (plugins run outermost-first as under Bottle; /ping public; /openapi public iff openapi_insecure — note the issue text had this inverted, Bottle's code is followed; unmatched routes run no view; with CORS the OPTIONS preflight is open, as Bottle's CORS plugin answers before auth), after_request CORS headers, claims on request.token (reachable through current_request).
• A plugin without authenticate (Bottle-only) still raises NotImplementedError: never silently dropped.
• publish_swagger via swagger_ui.api_doc (Flask supported); guarded by the plugins like any route (as under Bottle).
• Tests parametrized over bottle/flask (test_flask_plugins.py): 295 passed (271 before).

Auth is security-sensitive. Adversarial review (fresh Opus, security): round 1 found a MEDIUM bypass (ping/openapi exempted by endpoint name, so a user function named openapi with openapi_insecure was public under Flask) and a LOW (duck-typed authenticate). Both fixed (exemption by view-function identity; plugins must subclass py2http.auth.AuthPlugin) with regression tests. Round 2 on the fixed state: PASS, no bypass, Bottle behaviour identical to master across the request matrix. Tests: 297 passed.

🤖 Generated with Claude Code