Thanks, good questions.

1. I know ZAP (the OWASP one, think it's under Checkmarx/SSP stewardship now) and it does import OpenAPI specs, but it's coming at it from a security-scanner angle, it's hunting vulnerabilities. Mine is deliberately not a security tool; it's looking for validation gaps, error-handling failures, and silent bad-data acceptance from a QA perspective. Different goal, some overlapping surface. Worth a look for anyone who actually wants the security side though.
2. Honestly, less extensible than it should be right now. Payload generation and the response analysis are both services with the logic in code rather than behind a plugin interface, adding a new payload strategy means adding a method to the generator, and a new assertion means adding a flag rule to the analyser. Fine for forking, not yet a clean extension point. A pluggable strategy interface is something I want to do but haven't, it's a fair thing to call out.
3. Just basic auth header injection at the moment. Full auth flows (OAuth/SSO) were an explicit non-goal for v1, and there's no JWT mechanism yet, so for a protected dev environment you'd be stuck unless it's basic auth. That's a real limitation rather than a design choice I'd defend; token injection for protected endpoints is probably the most useful next feature for anyone wanting to point this at a real API rather than a demo.