Summary

Self-hosted PaddleOCR-VL parser configuration currently supports the service endpoint and recognition options, but it does not provide an optional API Key/token field. This makes it hard to place the PaddleOCR-VL pipeline behind an API gateway, ingress auth layer, or private service proxy that expects Bearer authentication.

Proposal

Add an optional API Key for the self-hosted paddleocr_vl parser. When configured, WeKnora should send it as:

Authorization: Bearer <API Key>

The field should be optional and preserve current behavior when empty.

Expected behavior

• Parser Engine settings show an optional API Key field for self-hosted PaddleOCR-VL.
• Parser availability checks include the Authorization header when the key is configured.
• Actual /layout-parsing parse requests include the same Authorization header.
• Existing deployments without a key continue to work unchanged.

Why this is useful

Many self-hosted PaddleOCR-VL services are deployed behind protected gateways or internal auth middleware. Supporting an optional key avoids exposing the parsing endpoint without authentication while keeping the simple endpoint-only setup working.