fix(server-card): declare conditional authentication as optional

[huige66631]

Problem

The server card declares authentication.required: true, and server.json marks the Authorization header as required. This is inaccurate for the hosted ?tools= surface, where search-actors, fetch-actor-details, search-apify-docs, and fetch-apify-docs work without an Apify token.

Solution

Declare authentication as optional in both discovery metadata formats and document that a token remains required for the default tool set and non-public tools. This keeps the metadata aligned with the existing runtime authorization policy without changing access control.

Changes

• Set server-card authentication to optional while retaining bearer and OAuth2 schemes.
• Mark the Authorization header in server.json as optional and document the anonymous ?tools= surface.
• Add unit coverage for both metadata declarations.

Testing

• pnpm run type-check
• pnpm run lint
• pnpm run test:unit
• pnpm run format:check
• pnpm run check:agents
• Manual metadata and authorization-policy check: public tools remain anonymous; default and private tools still require a token.

Notes for Reviewer

This PR intentionally does not change runtime authentication. isApiTokenRequired() continues to require a token when no tool selection is supplied or when any non-public tool is selected. The private hosted-server repository may need its matching server-card assertion updated when this change is released.

Fixes #1170

[MQ37]

Thank you for the PR! I would honestly not merge this as this PR is saying that this server on URL mcp.apify.com does not require auth when in reality for this exact URL without any ?tools= it does. Also the server.json SEP does not have any way to communicate under what conditions the bearer auth header is require or not so I would defensively keep it as required. What do you think? @jirispilka

[huige66631]

Thanks, that makes sense. I agree that the default mcp.apify.com endpoint requires a token, and marking authentication as optional would make the server card and server.json misleading.

I will not pursue this metadata change as-is. Would you prefer me to close this PR, or is there a specific way you would like the public ?tools= surface documented without weakening the required-auth contract?

[jirispilka]

Thank you for the PR! I would honestly not merge this as this PR is saying that this server on URL mcp.apify.com does not require auth when in reality for this exact URL without any ?tools= it does. Also the server.json SEP does not have any way to communicate under what conditions the bearer auth header is require or not so I would defensively keep it as required. What do you think? @jirispilka

@huige66631 thank you but I agree with @MQ37 let's close it