improvement(api): declare OAuth scopes in OpenAPI, JSON 404s for unknown API paths, and root MCP resource metadata (#9026)

* improvement(api): declare OAuth scopes in OpenAPI, JSON 404s for unknown API paths, and root MCP resource metadata

* fix(api): shrink the unused-exports baseline and keep rewrite checks out of the dev-server e2e

Author: waleedlatif1

apps/docs/lib/openapi.ts

@@ -173,7 +173,7 @@ function resolveAuthHeaders(
       headers[scheme.name] = AUTH_SAMPLE_VALUE
       continue
     }
-    if (scheme.type === 'http' && scheme.scheme === 'bearer') {
+    if (scheme.type === 'oauth2' || (scheme.type === 'http' && scheme.scheme === 'bearer')) {
       headers.Authorization = `Bearer ${AUTH_SAMPLE_VALUE}`
       continue
     }

apps/docs/openapi-v2-billing.json

@@ -43,6 +43,14 @@
         "x-sim-operation": "billing.status.read",
         "x-oauth-scope": "api:read",
         "tags": ["Billing"],
+        "security": [
+          {
+            "apiKey": []
+          },
+          {
+            "oauthBearer": ["api:read"]
+          }
+        ],
         "parameters": [
           {
             "name": "workspaceId",
@@ -111,6 +119,14 @@
         "x-sim-operation": "billing.logs.list",
         "x-oauth-scope": "api:read",
         "tags": ["Billing"],
+        "security": [
+          {
+            "apiKey": []
+          },
+          {
+            "oauthBearer": ["api:read"]
+          }
+        ],
         "parameters": [
           {
             "name": "source",
@@ -263,10 +279,20 @@
         "description": "Your Sim API key, personal or workspace-scoped. Generate one under Settings, then API Keys. Operations that reject workspace keys say so in their own description."
       },
       "oauthBearer": {
-        "type": "http",
-        "scheme": "bearer",
-        "bearerFormat": "OAuth 2.0 access token",
-        "description": "A Sim OAuth access token obtained by a registered client through the authorization-code flow. Each operation declares its required scope: api:read permits reads and searches; api:write also permits changes and execution and implies api:read. Scope requirements follow the application operation, independent of HTTP method or workspace role."
+        "type": "oauth2",
+        "description": "A Sim OAuth access token obtained by a registered client through the authorization-code flow with PKCE (S256), sent as `Authorization: Bearer`. Each operation declares the scope it requires: api:read permits reads and searches; api:write also permits changes and execution and implies api:read. Scope requirements follow the application operation, independent of HTTP method or workspace role.",
+        "flows": {
+          "authorizationCode": {
+            "authorizationUrl": "https://www.sim.ai/api/auth/oauth2/authorize",
+            "tokenUrl": "https://www.sim.ai/api/auth/oauth2/token",
+            "refreshUrl": "https://www.sim.ai/api/auth/oauth2/token",
+            "scopes": {
+              "api:read": "Read your workspaces, workflows, files, tables, and logs",
+              "api:write": "Read, create, change, run, and delete resources in your workspaces",
+              "offline_access": "Stay signed in without asking again"
+            }
+          }
+        }
       }
     },
     "headers": {