fix(server-card): declare conditional authentication as optional

[huige66631]

Problem

The server card declares authentication.required: true, and server.json marks the Authorization header as required. This is inaccurate for the hosted ?tools= surface, where search-actors, fetch-actor-details, search-apify-docs, and fetch-apify-docs work without an Apify token.

Solution

Declare authentication as optional in both discovery metadata formats and document that a token remains required for the default tool set and non-public tools. This keeps the metadata aligned with the existing runtime authorization policy without changing access control.

Changes

• Set server-card authentication to optional while retaining bearer and OAuth2 schemes.
• Mark the Authorization header in server.json as optional and document the anonymous ?tools= surface.
• Add unit coverage for both metadata declarations.

Testing

• pnpm run type-check
• pnpm run lint
• pnpm run test:unit
• pnpm run format:check
• pnpm run check:agents
• Manual metadata and authorization-policy check: public tools remain anonymous; default and private tools still require a token.

Notes for Reviewer

This PR intentionally does not change runtime authentication. isApiTokenRequired() continues to require a token when no tool selection is supplied or when any non-public tool is selected. The private hosted-server repository may need its matching server-card assertion updated when this change is released.

Fixes #1170