v2 makes httpAuth mandatory on every integration definition: it is the
server-owned authentication the Stats widget and arbitrary requests reuse.
Both APIs take the key in an X-API-KEY header; Site Manager reads it from
its own secret kind.
Also split the inline type imports v2's stricter oxlint rejects.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>