feat(api): Add per-operation security definitions to OpenAPI specs

- Set global security to BearerAuthentication only (best practice)
- Add per-operation security to v1 endpoints (all 4 auth schemes)
- Add per-operation security to v2 endpoint (Bearer + Token)
- Add no-auth option for initial token creation endpoint
- Fix TOC sidebar to include security scheme headings (move id to h3)
- Update Authentication tag table to accurately describe endpoint support

api-docs/influxdb3/core/v3/ref.yml

@@ -40,9 +40,6 @@ servers:
         description: InfluxDB 3 Core URL
 security:
   - BearerAuthentication: []
-  - TokenAuthentication: []
-  - BasicAuthentication: []
-  - QuerystringAuthentication: []
 tags:
   - name: Authentication
     description: |
@@ -51,9 +48,9 @@ tags:
       | Authentication scheme | Works with |
       |:----------------------|:-----------|
       | Bearer authentication | All endpoints |
-      | Token authentication  | v1, v2 endpoints |
-      | Basic authentication  | v1 endpoints |
-      | Querystring authentication | v1 endpoints |
+      | Token authentication  | v1 and v2 compatibility endpoints (`/write`, `/query`, `/api/v2/write`) |
+      | Basic authentication  | v1 compatibility endpoints (`/write`, `/query`) |
+      | Querystring authentication | v1 compatibility endpoints (`/write`, `/query`) |
 
       See the **Security Schemes** section below for details on each authentication method.
     x-traitTag: true
@@ -326,6 +323,11 @@ paths:
           description: Access denied.
         '413':
           description: Request entity too large.
+      security:
+        - BearerAuthentication: []
+        - TokenAuthentication: []
+        - BasicAuthentication: []
+        - QuerystringAuthentication: []
       tags:
         - Write data
       x-influxdata-guides:
@@ -414,6 +416,9 @@ paths:
           description: Access denied.
         '413':
           description: Request entity too large.
+      security:
+        - BearerAuthentication: []
+        - TokenAuthentication: []
       tags:
         - Write data
       x-influxdata-guides:
@@ -835,6 +840,11 @@ paths:
           description: Method not allowed.
         '422':
           description: Unprocessable entity.
+      security:
+        - BearerAuthentication: []
+        - TokenAuthentication: []
+        - BasicAuthentication: []
+        - QuerystringAuthentication: []
       tags:
         - Query data
       x-influxdata-guides:
@@ -952,6 +962,11 @@ paths:
           description: Method not allowed.
         '422':
           description: Unprocessable entity.
+      security:
+        - BearerAuthentication: []
+        - TokenAuthentication: []
+        - BasicAuthentication: []
+        - QuerystringAuthentication: []
       tags:
         - Query data
       x-influxdata-guides:
@@ -1706,8 +1721,10 @@ paths:
                 $ref: '#/components/schemas/AdminTokenObject'
         '401':
           $ref: '#/components/responses/Unauthorized'
+      security:
+        - BearerAuthentication: []
+        - {} # No auth required for initial token creation
       tags:
-        - Authentication
         - Auth token
   /api/v3/configure/token/admin/regenerate:
     post:

api-docs/influxdb3/enterprise/v3/ref.yml

@@ -37,9 +37,6 @@ servers:
         description: InfluxDB 3 Enterprise URL
 security:
   - BearerAuthentication: []
-  - TokenAuthentication: []
-  - BasicAuthentication: []
-  - QuerystringAuthentication: []
 tags:
   - name: Authentication
     description: |
@@ -47,9 +44,9 @@ tags:
       | Authentication scheme | Works with |
       |:----------------------|:-----------|
       | Bearer authentication | All endpoints |
-      | Token authentication  | v1, v2 endpoints |
-      | Basic authentication  | v1 endpoints |
-      | Querystring authentication | v1 endpoints |
+      | Token authentication  | v1 and v2 compatibility endpoints (`/write`, `/query`, `/api/v2/write`) |
+      | Basic authentication  | v1 compatibility endpoints (`/write`, `/query`) |
+      | Querystring authentication | v1 compatibility endpoints (`/write`, `/query`) |
       See the **Security Schemes** section below for details on each authentication method.
     x-traitTag: true
   - name: Cache data
@@ -290,6 +287,11 @@ paths:
           description: Access denied.
         '413':
           description: Request entity too large.
+      security:
+        - BearerAuthentication: []
+        - TokenAuthentication: []
+        - BasicAuthentication: []
+        - QuerystringAuthentication: []
       tags:
         - Write data
       x-influxdata-guides:
@@ -378,6 +380,9 @@ paths:
           description: Access denied.
         '413':
           description: Request entity too large.
+      security:
+        - BearerAuthentication: []
+        - TokenAuthentication: []
       tags:
         - Write data
       x-influxdata-guides:
@@ -787,6 +792,11 @@ paths:
           description: Method not allowed.
         '422':
           description: Unprocessable entity.
+      security:
+        - BearerAuthentication: []
+        - TokenAuthentication: []
+        - BasicAuthentication: []
+        - QuerystringAuthentication: []
       tags:
         - Query data
       x-influxdata-guides:
@@ -899,6 +909,11 @@ paths:
           description: Method not allowed.
         '422':
           description: Unprocessable entity.
+      security:
+        - BearerAuthentication: []
+        - TokenAuthentication: []
+        - BasicAuthentication: []
+        - QuerystringAuthentication: []
       tags:
         - Query data
       x-influxdata-guides:
@@ -1747,8 +1762,10 @@ paths:
                 $ref: '#/components/schemas/AdminTokenObject'
         '401':
           $ref: '#/components/responses/Unauthorized'
+      security:
+        - BearerAuthentication: []
+        - {} # No auth required for initial token creation
       tags:
-        - Authentication
         - Auth token
   /api/v3/configure/token/admin/regenerate:
     post:

layouts/partials/api/security-schemes.html

@@ -19,8 +19,8 @@
     <section class="api-security-schemes">
       <h2 id="security-schemes">Security Schemes</h2>
       {{ range $name, $scheme := . }}
-      <div class="security-scheme" id="scheme-{{ $name | urlize }}">
-        <h3>{{ $name }}</h3>
+      <div class="security-scheme">
+        <h3 id="scheme-{{ $name | urlize }}">{{ $name }}</h3>
         <div class="scheme-details">
           <dl>
             <dt>Type</dt>