[WMK666666]

docling-serve has no built-in authentication: it is normally deployed behind a proxy, and the
oauth-proxy deployment described in its docs authenticates on an Authorization: Bearer header.

DoclingServeClient only knows an API key, which it always sends as X-Api-Key, so there was no way to
talk to a docling-serve sitting behind that proxy.

Change

• DoclingServeApiConfig.BEARER_TOKEN (bearerToken, String), with an accessor on the config and a
  setter on DoclingServeApiBuilder.
• DoclingServeClient.createRequestBuilder sends it as Authorization: Bearer <token> on every request,
  independently of apiKey. Both may be set at once, for a proxy that asks for one and docling-serve
  itself for the other.
• The Authorization value is masked by the same code that masks X-Api-Key when request logging is on.
• The setter is not added to the deprecated DoclingApiBuilder interface, which is documented as not
  gaining new configuration options, so third-party implementations of it keep compiling.
  LegacyProviderAdapter therefore reports bearerToken as Unsupported.FAIL: a caller going through a
  legacy factory gets an error naming the factory, instead of the token being silently dropped.

Tests

• DoclingServeClientBearerTokenTests (new, WireMock): the header is sent, it is not sent when no token is
  configured, it is independent of the API key, and bearerToken(null) unsets the option.
• DoclingServeApiConfigTests and AbstractDoclingServeClientConfigTests: the new option is reported by
  the config and appears in explicitlySetOptions(), which keeps the guards that every option has an
  accessor and a setter passing.
• LegacyProviderAdapterTests: bearerToken is listed as unsupported for legacy factories.

./gradlew :docling-serve-api:test :docling-serve-client:test passes locally, except for the two
*ClientTests classes that start a docling-serve container, which need Docker and were not run here.

Docs

docs/src/doc/docs/docling-serve/serve-client.md gains an Authentication section covering both
credentials.