Seeing this is an unusual construct for curl code, can you add a comment here explaining why plain ; is not enough?

Simply put it: Compilers. gcc warns about orphaned ; in the source code. This warning is also enabled by the -Wextra flag. I'm not sure about the reason, I would guess it prevents programming errors like this:

if (foo);
   do_stuff();

Yes, and I want that as a comment in the code so that future readers understand that is the reason why this construct is used...

Misread, will add!

Tbh, I personally find this macro spaghetti quite hard to understand. Would you be fine if I refactor this into static functions too?

Something like this: (pseudocode)

static bool handle_ntlm(const char *auth, ...) {
#ifdef USE_NTLM
  if (!checkprefix("Negotiate", auth) || !is_valid_auth_separator(auth[9])) {
    return false;
  }
  // NTLM auth code
  return true;
#else
  (void)auth;
  // ...
  return false;
#endif
}

// ...

CURLcode Curl_http_input_auth(struct Curl_easy *data, bool proxy,
                              const char *auth) /* the first non-space */
{
// ...
  if (handle_ntlm(auth, ...)) {
  } else if (handle_basic(auth, ...)) {
  } else if (handle_...(auth, ...)) {
  } else ...

The compiler would still eliminate empty functions, but I find it less noisy to read as the macros don't need to workaround syntactic issues. Do you think this could help readability?

Yes I think it would. Reducing ifdef-mazes is a worthy effort.

The PR is finished as is, I'll open a new one for the refactoring. (I know myself, my attention is a squirrel.)