[wklken]

apigateway apply_gateway_permission previously accepted access-token contexts and access tokens supplied through X-Bkapi-Authorization, allowing token users to submit permission applications on behalf of an application. Require an app_user context with non-empty bk_app_code and bk_app_secret, reject access/personal-token contexts and Bearer headers, and validate authentication header overrides before preview or submission. Rejections return unsupported_credential_type without sending a request.

Update help and usage documentation to tell agents to stop when only tokens are available and ask the application developer to handle the application, without bypassing the restriction through raw API calls, header overrides, or retries. This is a command-local guard; server-side enforcement is still required to restrict direct API calls.

Validation on the current master base:

• make fmt (unrelated formatter-only output excluded)
• make lint: 0 issues
• make test: all 26 suites passed, including the integration runner
• make build and built-binary help inspection
• make test-integration SCENARIO=APIGW-NEG-001: 13 steps passed
• make test-integration CASE=tests/integration/cases/system/apigateway/APIGW-007-apigateway-apply-gateway-permission.yaml: 6 steps passed
• Regression tests cover rejected credential types, mixed/malformed authentication overrides, case-insensitive header precedence, no outbound request on rejection, and successful app-credential submissions.

The PR contains only this permission-application fix; the separate MCP work is excluded.