Windsurf generated an API without any auth, how do I add it afterwards?

Don't do it per endpoint. One dependency, applied to the router:

async def current_user(token: str = Depends(oauth2_scheme)) -> User: ...

router = APIRouter(dependencies=[Depends(current_user)])

Every route under that router now requires auth, including the ones you add next month. Keep a separate router for the two public routes (health, login). Then ask Windsurf to move the endpoints between the two routers; that's a task it does well.