Accept optional Bearer prefix on API token

The REST API only accepted the API token bare
('Authorization: <token>') and rejected the RFC 6750 bearer form
('Authorization: Bearer <token>'). Bearer is what most HTTP clients,
SDKs, API tools, and AI agents send by default, so users routinely got
an authentication failure with no indication of the cause.

api_token_parse_credentials() strips an optional 'Bearer ' prefix
before the token lookup. The scheme name is matched case-insensitively,
and SP or HTAB between the scheme and the token is tolerated per
RFC 7230. Credentials using any other scheme (e.g. 'Basic ...') are
returned unchanged and continue to fail token validation as before.

The bare form remains fully supported, so the change is additive. An
invalid token is handled identically with or without the prefix, so no
separate code path or failure mode is introduced.

Also documents both accepted forms in the OpenAPI and Swagger
definitions.

Fixes 0037333