[DOCS] A2A agent credentials from a file or a command #992

Summary

inference-gateway/cli#1550 adds two credential sources to the auth block of agents.yaml, an optional scopes list on the oidc block, and three examples that put an A2A agent behind Google, Microsoft Entra ID and Amazon Cognito. The site's a2a.md page, section "Authenticating to A2A Agents", documents token_env and oidc only and says "Set exactly one mode per agent, token_env or oidc, not both", which is now out of date.

User-facing behavior to document:

• auth.token_file - path of a file holding the bearer token. It is re-read on every request, so a token rotated in place by the kubelet (projected service account token), spiffe-helper (JWT-SVID) or Vault Agent is picked up without a restart. Nothing is provisioned to the CLI.
• auth.token_command - argv of a command whose trimmed stdout is the bearer token. It runs without a shell under a 10 second timeout. The token is reused until it expires: the exp claim when it is a JWT, otherwise five minutes. It is honoured from ~/.infer/agents.yaml only. In a project .infer/agents.yaml it is refused with Authentication failed for A2A agent "<name>": token_command is only read from ~/.infer/agents.yaml, because a project file arrives with a clone and the agent card is fetched without approval. A failing command is reported by its name and exit status, never by its output.
• auth.oidc.scopes (optional) - scopes requested on top of the ones the agent card lists. Microsoft Entra ID requires api://<api app id>/.default on client credentials and the ADK card declares no scopes.
• Exactly one of token_env, token_file, token_command and oidc per agent.
• infer agents show prints bearer token from file <path> and bearer token from command <argv[0]> (arguments are not shown).

Examples to add:

# .infer/agents.yaml
agents:
  - name: research
    url: https://research.example.com
    auth:
      token_file: /var/run/secrets/kubernetes.io/serviceaccount/token

# ~/.infer/agents.yaml
agents:
  - name: billing
    url: https://billing.example.com
    auth:
      token_command: [gcloud, auth, print-identity-token, --audiences=https://billing.example.com]

auth:
  oidc:
    client_id: <client app id>
    client_secret_env: AZURE_CLIENT_SECRET
    issuer_url: https://login.microsoftonline.com/<tenant id>/v2.0
    scopes: [api://<api app id>/.default]

Affected pages:

• a2a.md, "Authenticating to A2A Agents": add "Bearer token from a file" and "Bearer token from a command" subsections between the static token and OIDC subsections, add scopes to the OIDC field list, fix the "exactly one mode" sentence, and link the new examples next to the a2a-auth link.
• authentication.md, "Identity providers" or "Runnable examples": one line pointing at the CLI side, since this page already lists Entra, Google and Cognito for the gateway.

Source of truth in the CLI repository: docs/agents-configuration.md section "Authentication", and the examples examples/a2a-auth-gcp, examples/a2a-auth-entraid, examples/a2a-auth-aws.

Source PR: inference-gateway/cli#1550

Acceptance Criteria

• a2a.md documents token_file and token_command with the file-rotation, caching, timeout and userspace-only rules above, and the exactly-one rule names all four sources.
• a2a.md lists auth.oidc.scopes in the OIDC field list with the Entra note.
• a2a.md links the a2a-auth-gcp, a2a-auth-entraid and a2a-auth-aws examples.
• authentication.md points at the CLI-side credential options for the providers it already lists.