[pranems]

Summary

Higher-priority authentication-only change, split from the larger authentication/reporting work.

• Declare available authentication methods explicitly and require every selected method to pass (AND).
• Treat undeclared methods as Not applicable without issuing their token requests.
• Select direct SCIM transport independently within the declaration.
• Acquire and refresh OAuth/federation access tokens at runtime, without static-token fallback.
• Keep bearer-only validation from establishing gallery authentication readiness.
• Update the canonical onboarding agent and focused authentication documentation.
• Advance the authentication bundle from 13.0 to 14.0.

Scope

The portable reporting exporter, reporting regression suite, automatic reporting-startup events, and reporting integration are intentionally excluded. The reporting follow-up is dependent and will be reviewed separately.

This commit preserves the intended functional HTTP contracts apart from the authentication changes. It does not claim to fix unrelated endpoint or group-functional failures.

Verification

• 6,075 offline authentication assertions passed, including all 99 direct SCIM request guards.
• JSON/PowerShell syntax, documentation links, exact LF version bytes, and source/parameter version equality checked.
• Split/isolation checks confirmed that no reporting implementation leaked into this branch.

Fresh validation status

Draft pending the new, agent-based, first-time deployment and validation run using fresh Logic App and Entra resources. The authentication session exclusively owns this run; no live federation certification is claimed for an OAuth-only environment.

Historical results from the earlier combined bundle are not certification of this separated commit. Any genuine functional failures will remain visible rather than being converted into authentication success or readiness.

Review order

Review this authentication change first. The reporting review is the reporting-only stacked draft pranems#1, because contributors cannot create an upstream authentication base branch with read-only upstream access.