[Zhoujie628]

Closes #90

Summary

• Separate registry/orchestration HTTP authentication from agent-channel authentication; support fixed/dynamic Bearer and business-defined headers.
• Add per-client strict/custom-CA/mTLS/insecure TLS policies without changing JVM-wide defaults; disable redirects and retain request deadlines.
• Support the orchestration login-page account for PSOP search/loading: obtain a Bearer session through /api/v1/auth/token, cache it until expiry, and renew it by logging in again.
• Retry a read-only PSOP request at most once after an account-session 401. Never replay agent execution, registry writes, or requests rejected with 403/429/5xx. Keep account credentials scoped to the configured center and sanitize authentication failures.
• Add sample account configuration and reject incomplete or mixed account/Bearer settings. Reuse the same explicit TLS policy for login and PSOP access; center failure never silently falls back to anonymous access or an offline workflow.
• Protect both non-success and malformed successful responses against credential leakage. Close execution-owned runtimes on preparation failures.
• Update bilingual API/integration examples and regression coverage. Task, authorization and notification channel lifecycles are unchanged.

Validation

• Java 17 / Maven 3.9.16: mvn -B -ntp clean verify: 437 tests, zero failures/errors/skips, including direct Spring end-to-end and authentication failure paths.
• Personal dev branch: mvn -B -ntp clean verify: 538 tests, zero failures/errors/skips, including direct and adapter protocol-simulator end-to-end paths.
• Spotless, Checkstyle and SpotBugs passed; sources/Javadoc packaging succeeded.
• Started the full current orchestration service and validated Java PSOP login/search/load over HTTP, HTTPS with a trusted private CA, and explicitly insecure HTTPS: session expiry, logout-triggered 401 recovery, invalid credentials, and anonymous rejection passed. Only the model backend was a local protocol simulator; this is not a live external-model/business-platform acceptance claim.
• Negative control: the previous PSOP loader fails to recover after real service logout, while the new loader succeeds.
• Explicit staged-file selection, whitespace and secret checks passed. Local secrets, runtime data and internal review materials are excluded.

Public common changes are submitted to main. The same commit is cherry-picked to the personal fork's dev branch, preserving its existing adapter-only differences; upstream has no dev branch.

For maintainer review; do not auto-merge.

Follow-up: current documentation and deployment contracts

• Update README prerequisites and both development guides to independent registry credentials plus a shared orchestration account provider/TLS policy.
• Move blocking login/PSOP reads off the reactive event loop; fix callback completion, cancellation and framework-owned SSE framing in the host example.
• Extend extracted documentation compilation tests to the account fields/PSOP call. The full WebFlux host is illustrative and is not compiled by the sample test.
• Declare the SSE response media type explicitly in both reactive examples and anchor it in documentation tests.

Validation: main mvn spotless:check verify -DskipITs passed (437 tests, zero failures/errors); dev passed independently (538 tests). The subsequent SSE media-type correction passed the targeted documentation compilation test and Spotless on both branches. Main follow-ups were cherry-picked to the personal dev branch. This follow-up changes documentation and documentation tests, not the public authentication API.