test: cover Xquik api key security

[kriptoburak]

Summary

• Add an OpenAPI 3.1 search operation fixture based on Xquik's public searchTweets contract.
• Assert a registered apiKey security handler authorizes the canonical x-api-key header.

Validation

• npm ci
• npx jest src/backend.test.ts --runInBand
• npm run build
• npx prettier --check src/backend.test.ts
• git diff --check