Surface plugin auth strategies and OAuth 2.0 in the skill

Authentication was only covered in references/requests.md, so an agent
that never opened it had no reason to know the schema enumerates every
installed strategy, including plugin-contributed ones. OAuth 2.0 was not
mentioned in the always-loaded file at all.

SKILL.md now shows how to list the strategies and dump one's shape, and
calls out that the variant title is a display label rather than the
authenticationType value ("NTLM Auth" is `windows`, "AWS Signature" is
`awsv4`). Auth is in the frontmatter description too, so the skill
triggers on requests to add auth to a request.

requests.md gains a worked OAuth 2.0 payload, verified against the schema
and round-tripped through the model.

crates-cli/yaak-cli/skills/use-yaak/SKILL.md

@@ -2,15 +2,16 @@
 name: use-yaak
 description: >
   Build and run HTTP API requests with the Yaak CLI (`yaak`): create workspaces,
-  folders, environments and variables, author HTTP requests, send them
-  individually or a whole folder/workspace at once, chain one request's response
-  into the next, and import existing APIs from OpenAPI, Postman, Insomnia, or
-  cURL. Use this skill whenever the user mentions Yaak, a Yaak workspace, or the
-  `yaak` command, and also when they ask to try, hit, call, exercise, or smoke
-  test an HTTP or REST endpoint, to save or organize API requests for reuse, to
-  set up API requests for manual testing, to turn an OpenAPI or Postman
-  collection into runnable requests, or to run a saved request suite against
-  staging versus production. Prefer this over one-off `curl` commands whenever
+  folders, environments and variables, author HTTP requests, configure
+  authentication (OAuth 2.0, bearer tokens, API keys, basic, JWT, AWS SigV4),
+  send them individually or a whole folder/workspace at once, chain one
+  request's response into the next, and import existing APIs from OpenAPI,
+  Postman, Insomnia, or cURL. Use this skill whenever the user mentions Yaak, a
+  Yaak workspace, or the `yaak` command, and also when they ask to try, hit,
+  call, exercise, or smoke test an HTTP or REST endpoint, to save or organize
+  API requests for reuse, to set up API requests for manual testing, to add auth
+  to a saved request, to turn an OpenAPI or Postman collection into runnable
+  requests, or to run a saved request suite against staging versus production. Prefer this over one-off `curl` commands whenever
   the requests should be saved, reused, shared, or run as a set.
 allowed-tools: Bash(yaak:*), Bash(which:*), Bash(command:*), Bash(npm:*), Bash(npx:*)
 ---
@@ -95,6 +96,32 @@ authentication variants:
 yaak request schema http --pretty
 ```
 
+That schema is also the authoritative list of **authentication strategies**,
+including ones contributed by plugins. Each appears as a named variant under
+`authentication`, with its own fields, required list, and enums, so there is
+never a reason to guess auth config:
+
+```bash
+# every installed strategy, with the value to use for authenticationType
+yaak request schema http | jq -r '.properties.authentication.oneOf[]
+  | select(.title) | "\(.title): \(.description)"'
+
+# the full shape of one of them
+yaak request schema http | jq '.properties.authentication.oneOf[]
+  | select(.title == "OAuth 2.0")'
+```
+
+The first prints lines like `OAuth 2.0: Authentication values for strategy
+'oauth2'`. **The title is a display label, not the value** — `authenticationType`
+takes the quoted strategy name, so NTLM Auth is `windows` and AWS Signature is
+`awsv4`.
+
+The second prints the fields. OAuth 2.0 has fifteen of them plus an enum of valid
+`grantType` values (`authorization_code`, `implicit`, `password`,
+`client_credentials`), which is exactly the sort of thing that comes out wrong
+when guessed. The command loads plugins, so it reflects what is actually
+installed rather than a fixed list, and it returns in well under a second.
+
 Rules that are easy to get wrong:
 
 - **Setting `bodyType` does not add a `Content-Type` header.** The app adds one