Support Workforce bearer token as alternative to email/password OAuth

Adds bearer_token secret field — if configured, the auth service uses it
directly and skips the OAuth password grant entirely. Falls back to
email/password flow if no token is set.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/integrations/schema.js

@@ -30,7 +30,7 @@ export const INTEGRATIONS = {
   workforce: {
     name: 'Workforce',
     configFields: ['base_url', 'sync_hours'],
-    secretFields: ['email', 'password'],
+    secretFields: ['bearer_token', 'email', 'password'],
   },
   smtp: {
     name: 'SMTP Email',

src/routes/integrations.js

@@ -89,6 +89,15 @@ export async function integrationRoutes(app) {
       else if (req.params.slug === 'resos') await resosTest(creds)
       else if (req.params.slug === 'workforce') {
         const baseUrl = creds.base_url || 'https://my.workforce.com'
+        if (creds.bearer_token) {
+          // Test bearer token directly with a lightweight API call
+          const res = await fetch(`${baseUrl}/api/v2/users?page=1&page_size=1`, {
+            headers: { Authorization: `Bearer ${creds.bearer_token}` },
+            signal: AbortSignal.timeout(8000),
+          })
+          if (!res.ok) throw new Error(`Workforce bearer token invalid (${res.status})`)
+        } else {
+          if (!creds.email || !creds.password) throw new Error('No bearer token or email/password configured')
           const res = await fetch(`${baseUrl}/api/oauth/token`, {
             method: 'POST',
             headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
@@ -99,6 +108,7 @@ export async function integrationRoutes(app) {
           const data = await res.json()
           if (!data.access_token) throw new Error('No access token returned')
         }
+      }
       else if (req.params.slug === 'smtp') {
         const nodemailer = await import('nodemailer')
         const transporter = nodemailer.default.createTransport({