[codex] Make Swagger match backend behavior

[jjoonleo]

Summary

• Align OpenAPI security with the backend auth filter behavior by documenting the real access and refresh token headers.
• Stop public endpoints from inheriting JWT security in generated Swagger.
• Remove phantom GET request bodies and stale hand-written response examples so generated schemas reflect controller return types.
• Update auth endpoint docs to match filter-handled login/signup behavior and token response headers.
• Prevent Kakao login from appending a second JSON body after the filter already writes the login/register response.
• Add unit coverage for the Swagger customizer invariants.

Conflict resolution

• Merged latest origin/dev into codexd/swagger-coherent-openapi.
• Resolved the ApiResponseForm conflict by keeping dev's Object code behavior and preserving the Swagger schema metadata.

Validation

• git diff --check
• JAVA_HOME=/Users/ejunpark/.sdkman/candidates/java/17.0.12-oracle ./gradlew test --tests devkor.ontime_back.config.SwaggerConfigTest