fix: send profile auth headers when fetching the OpenAPI spec

[itsyoboieltr]

Summary

Profile auth settings (--api-basic-auth, --api-bearer-token, --custom-headers) were only applied to API requests, not when fetching the OpenAPI spec itself. A spec behind authentication (e.g. /openapi.json returning 401) could not be loaded.

What changed

• OpenapiLoader.loadSpec() accepts an optional headers option, passed to the axios request for the spec and any external $ref documents
• Added buildProfileAuthHeaders(profile) in cli.ts: merges custom headers and adds the Basic/Bearer Authorization header
• All loadSpec call sites (profiles add, API commands, command list/search) now pass the profile auth headers
• The existing request buildHeaders() reuses the same helper, so request behavior is unchanged

Verification

• All existing tests pass
• Manual check against a local HTTP server: spec requiring Bearer auth returns 401 without headers, loads with them; same for Basic auth

[EvilFreelancer]

Thanks for the fix, @itsyoboieltr - the problem was real (a spec behind auth could not be loaded at all) and your two commits are kept verbatim, with your authorship, in #23, which supersedes this PR.

A cross-review found two things on top of your change that are fixed there: the profile headers were also forwarded to external $ref documents on other hosts (a spec could hand the user's Authorization header to a third party), and the nested $ref hop (root -> A -> B) lost the headers because resolveRef rebuilt the context without them. #23 also gives OpenapiLoader an injectable HTTP client so the tests no longer need jest.mock("axios"), turns a 401/403 on the spec URL into a hint naming the auth flags, and documents the behavior in the README and --help.

Closing this one in favour of #23.