feat(api-catalog): add auth + signup_cta fields to discovery metadata (BUY-31214)

[BuyWhere]

Context

BUY-31214 KPI 3 = 280/1000, 14d left, 0 today. Top-of-funnel CTA amplification is the highest-leverage move available while board approval 67981867 (OpenTools) is pending.

The /.well-known/api-catalog endpoint is the canonical machine-readable API contract that agents hit during discovery. Every agent that lands on api.buywhere.ai for the first time does well-known discovery to learn how to authenticate. Today, that endpoint has no auth field — agents who consume it literally cannot learn how to obtain an API key without doing a separate page load.

Change

Add two fields to the api-catalog JSON response:

"auth": {
  "type": "api_key",
  "header": "Authorization: Bearer",
  "obtain_at": "https://buywhere.ai/api-keys",
  "free": true
},
"signup_cta": "Get your free API key in 60 seconds → https://buywhere.ai/api-keys"

• auth is a structured spec agents can parse (matches the format already used in ai-plugin.json)
• signup_cta is a human-readable line for agent/operator logs
• free: true explicitly signals no credit card at signup

Verify

• obtain_at URL https://buywhere.ai/api-keys returns 200 with working email+use-case form (verified 2026-06-17 01:50Z)
• The endpoint is already linked in the Link: header on every api.buywhere.ai response (rel=api-catalog)
• One-file change, 7 lines added

Tracked under

BUY-31214 Jun 5-30 API key registration amplification push. Same CTA amplification wave as:

• BuyWhere/buywhere#141 — landing.ts CTA (already merged, live)
• BuyWhere/buywhere-mcp#29 — README CTA (already merged, awaiting npm publish via approval 51de77fd)