[DOCS] Document per-agent A2A credentials in the CLI #985

Summary

Document how the CLI authenticates to A2A agents that protect /a2a.

An agent entry in agents.yaml can now carry an auth block with a static bearer token or an OIDC client-credentials grant. The block names environment variables and never holds a secret. For OIDC the CLI reads the token endpoint from the securitySchemes of the agent card, as the A2A protocol defines, so the entry only holds the client.

agents:
  - name: research
    url: https://research.example.com
    auth:
      token_env: RESEARCH_AGENT_TOKEN
  - name: billing
    url: https://billing.example.com
    auth:
      oidc:
        client_id: infer
        client_secret_env: BILLING_AGENT_CLIENT_SECRET
        audience: billing-agent                            # optional
        issuer_url: https://idp.example.com/realms/agents  # optional pin and fallback

Affected pages:

• a2a.md, "Using A2A with the Inference Gateway CLI": the auth block and its two forms, next to "Adding A2A Agents". Credentials have no infer agents add flags, so agents.yaml is edited directly.
• cli.md, "A2A Integration": which requests carry the credentials, that they are only sent to the agent's origin, and the error the model sees.

Fields to document:

• auth.token_env: environment variable holding a static bearer token.
• auth.oidc.client_id, auth.oidc.client_secret_env: the client of the client-credentials grant.
• auth.oidc.audience (optional): sent as the audience parameter of the token request.
• auth.oidc.issuer_url (optional): refuses a card that points at another issuer before the secret is sent, and names the issuer for an agent whose card declares no scheme.

Behaviour worth a sentence each:

• Set one mode per agent, token_env or oidc.
• Write the variable name, not ${VAR}.
• Every request to the agent carries the credentials: the agent card fetch, task submission, polling, cancellation and the liveness probe in infer agents status.
• Credentials are only sent to the scheme, host and port of the configured agent, never to another origin or a redirect target.
• An OIDC token is fetched once per process and refreshed shortly before it expires.
• A rejected request, a missing variable or a failed token request reaches the model as Authentication failed for A2A agent "<name>": ..., without the response body.
• infer agents show prints the mode and the variable name, never a secret.

Source: inference-gateway/cli#1542 (feature), inference-gateway/cli#1514 (ticket), inference-gateway/cli#1512 (example). The in-repo reference is docs/agents-configuration.md#authentication and docs/a2a-connections.md in the CLI repository, and examples/a2a-auth runs both modes against mock-agent and Keycloak.

Acceptance Criteria

• a2a.md documents the auth block with both forms, every field above and which fields are optional.
• The page states that secrets come from environment variables named in agents.yaml, and that the OIDC token endpoint comes from the agent card.
• cli.md states which requests carry the credentials and that they never leave the agent's origin.
• The Authentication failed for A2A agent error is documented with a short example.
• Either page links the examples/a2a-auth example.