fix: swagger doc/route mismatch, schema drift, security schemes, and 401 auth test failures

[oluebubejoy]

Fixes #539
Fixes #540
Fixes #541
Fixes #608

What changed

#539 — top-up undocumented; cancel @openapi sat above the wrong route

stream.routes.ts had the /cancel @openapi block sitting directly above the top-up route registration, so the generated spec attributed cancel's documentation to top-up and left POST /v1/streams/{streamId}/top-up entirely undocumented.

• Replaced the misplaced block with a proper @openapi spec for POST /v1/streams/{streamId}/top-up (requestBody: { amount: string }, 200/400/401/403/404 responses)
• The canonical cancel spec already lives in controllers/stream/cancel.ts — no duplicate needed

#540 — StreamEvent.eventType enum and Stream pause fields out of sync

swagger.ts component schemas were drifting from the real models:

• Extended StreamEvent.eventType enum with PAUSED, RESUMED, FEE_COLLECTED
• Added isPaused, pausedAt, totalPausedDuration, endTime to the Stream schema

#541 — bearerAuth / adminAuth security schemes undefined

Routes reference bearerAuth (lowercase) and adminAuth but only BearerAuth (capital) existed. Added both aliases to components.securitySchemes so Swagger UI renders the lock icon on every protected route.

#608 — 22 integration tests failing with blanket 401

Root cause: The async (importOriginal) => { ...actual, requireAuth: stub } factory pattern in vi.mock doesn't reliably apply in Vitest's pool: 'forks' mode. Because importOriginal is async and the forked worker processes module imports before the factory resolves, the real requireAuth can be registered before the mock is applied — causing dummy_token to fail JWT verification and return 401.

Fix:

• Replaced every async (importOriginal) factory with a plain synchronous factory that exports only requireAuth and requireAdmin stubs. Synchronous factories are guaranteed to be applied before any module imports resolve.
• Added JWT_SECRET: 'flowfi-test-secret-...' to vitest.config.ts env so verifyJwt is deterministic and the real middleware accepts properly-signed tokens even if a mock is not applied (belt-and-suspenders).

How to verify

cd backend
npm test
# expect: 0 test failures related to 401 in the 5 integration files

For swagger: start the server and visit /api-docs.json — both top-up and cancel appear under streams, StreamEvent.eventType includes all 8 values, Stream includes pause fields, and all three security schemes are listed.