Support Workforce bearer token as alternative to email/password OAuth

Adds bearer_token secret field — if configured, the auth service uses it
directly and skips the OAuth password grant entirely. Falls back to
email/password flow if no token is set.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/integrations/schema.js

@@ -30,7 +30,7 @@ export const INTEGRATIONS = {
   workforce: {
     name: 'Workforce',
     configFields: ['base_url', 'sync_hours'],
-    secretFields: ['email', 'password'],
+    secretFields: ['bearer_token', 'email', 'password'],
   },
   smtp: {
     name: 'SMTP Email',