feat(import): rich OpenAPI import — servers as environments, auth, bodies, URL fetch

[filipeforattini]

Summary

Major upgrade of the OpenAPI (3.x + Swagger 2, JSON and YAML) importer.

Servers → environments

• Each servers[] entry becomes a project environment named <API title> — <server description|host>, carrying its own {{baseUrl}} value plus one variable per server variable ({region} URL templating → {{region}}).
• The first created environment is activated after import, so imported requests run immediately; switching environments switches the basepath.
• Fallback vars (baseUrl et al.) merge into globals only for unset keys — fixes the pre-existing clobbering bug where every import overwrote baseUrl. baseUrl is never written to collection.vars (it would shadow environments in the scope cascade).

Richer collections

• Collection description from info.description (+ version, external docs); folder descriptions and ordering from root tags[]; request descriptions from op.description; deprecated flag rendered struck-through in the sidebar with a description tooltip.
• Stable request ids from operationId (oa-<slug>) for re-import friendliness.
• 2xx-first response examples become saved examples on each request.

Auth

• securitySchemes/security → AuthConfig: http bearer/basic, apiKey (header/query), oauth2 (clientCredentials / authorizationCode / password / Swagger 2 flows), openIdConnect (issuer). Per-operation security overrides; security: [] → none; default stays inherit. Credentials left empty for the user to fill.

Bodies

• application/json and *+json, x-www-form-urlencoded → form fields (required = enabled), multipart/form-data (binary-aware), XML (sampled via schema.xml.name), text/plain, raw fallback; Swagger 2 formData/body params honoring consumes.

Import from URL

• New importFromUrl: spec fetched through the engine sidecar (no CORS), then the regular auto-detect pipeline. ImportModal gains Paste | URL | File tabs; a bare URL pasted into the textarea is detected and fetched.

OpenAPI 3.1 tolerance

• type: ["string","null"] arrays, const, examples arrays, friendly error for webhooks-only documents.

Schema additions (backward-compatible zod defaults)

• RequestDefinition.description / .deprecated; FolderConfig.description.

Tests

• 19 new importer tests (rich 3.0 fixture, Swagger 2, 3.1 tolerance); pnpm -r check clean, 449 tests passing across the monorepo.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}