fix(auth): expose cookie OAuth model for OpenAPI

[gaoflow]

Summary

• Expose the OAuth2 OpenAPI model on OAuth2PasswordBearerWithCookie so FastAPI can emit a security scheme for it.
• Routes that use the cookie OAuth dependency currently make OpenAPI generation raise AttributeError, because the class (unlike the built-in OAuth2PasswordBearer) never set self.model.
• Added a test that generates the schema for a Depends(auth_scheme) route and asserts the password-flow security scheme is present.

Tests

• uv run --all-packages --all-extras --dev pytest backend/tests/auth/test_cookie.py -q
• uv run --all-packages --all-extras --dev pytest backend/tests/auth backend/tests/test_callbacks.py -q
• uv run pytest --cov=chainlit from backend/
• uv run scripts/lint.py
• uv run scripts/format.py --check
• uv run scripts/type_check.py

AI assistance was used under my direction.

[cubic-dev-ai]

No issues found across 2 files

_{Re-trigger cubic}

[dokterbob]

@codex review

[dokterbob]

@gaoflow #2961 doesn't exist and I am missing a rationale; what problem does this PR solve, e.g. what use cases does it enable?

[gaoflow]

This fixes a crash in OpenAPI generation: routes that use OAuth2PasswordBearerWithCookie make get_openapi() raise AttributeError, because unlike the built-in OAuth2PasswordBearer the class never set self.model (the OpenAPI security scheme). The PR sets the OAuth2 password-flow model and adds a schema-generation test. I also corrected the body — the #2961 reference was wrong; it isn't tied to an issue.