fix: honor optional request bodies

[kriptoburak]

Summary

• Add an OpenAPI 3.1 security fixture based on Xquik's public searchTweets contract.
• Verify a registered apiKey handler authorizes the canonical x-api-key header.
• Honor requestBody.required instead of inferring required bodies from media-type count.
• Add regression coverage for omitted optional request bodies.

The request-body fix also resolves #817 and its earlier duplicate #292.

Validation

• npm ci
• NODE_ENV=test jest --runInBand (294 tests)
• npm run build
• npm run lint
• npx prettier --check src/validation.ts src/validation.test.ts src/backend.test.ts
• git diff --check

[anttiviljami]

Nice, this is the right fix. The old "single media type ⇒ required" was never spec-compliant — requestBody.required defaults to false, so honoring the explicit flag is correct and closes #817/#292 properly.

Two small things:

• it does change validation behavior for anyone leaning on the old implicit-required, so let's make sure the release notes call out that optional bodies are now honored
• the apiKey searchTweets test is basically unrelated to the body fix — happy to keep it, but it's really its own thing. 👍