feat(api)!: remove api.access.token.required

[marevol]

Summary

Remove the api.access.token.required setting.

With api.access.token.required=true, RoleQueryHelper refused every API request that had neither a login session nor an access token. Until #3488 it refused requests with a valid token as well, so in practice the setting meant "the API is for logged-in users only" while the search screen stayed open to anonymous users.

That split no longer exists in 15.9. The default search UI is a static theme that calls /api/v2/search itself, so turning the setting on left anonymous visitors with an empty search page. login.required=true is the setting that keeps anonymous users from searching.

Changes

• fess_config.properties: remove api.access.token.required.
• FessConfig / FessProp: remove the key constant, the getters and the default map entry.
• RoleQueryHelper: drop the "token required" check and the import it used.
• SearchApiV2Manager / V2EnvelopeWriter: drop the setting from the comments about InvalidAccessTokenException.
• RoleQueryHelperTest: remove the tests that pinned the setting; keep one that checks an API request with a registered token gets the token's permissions and not the guest roles.

Access tokens behave as before: a registered token adds its permissions to the request, and an unregistered or expired token is still rejected by AccessTokenService (401 on /api/v2).

Migration

A value left under api.access.token.required has no effect. An installation that set it to true now answers anonymous API requests with the guest roles, the same as the search screen. To keep anonymous users from searching, set login.required=true.

Tests

• mvn -o formatter:format license:format
• mvn -o test -Dtest='RoleQueryHelperTest,*V2*Test,SearchApiV2*Test,org.codelibs.fess.api.v2.**.*Test': 574 tests, 0 failures, 0 errors
• grep for the key in the repository: no hits

Related

The documentation change is codelibs/fess-docs#557 (15.9 properties pages and upgrade notes). It describes this removal and should be merged together with, or after, this PR.

[utafrali]

Clean, complete removal of a setting that had become misleading after #3488. All references are gone, the guest-role fallback path is unaffected for the default case, and the test suite is updated accurately — removing the two tests that pinned the old enforcement behavior while keeping the one that validates token-permission assignment.

[utafrali]

The interface removes isApiAccessTokenRequired() as a breaking change, which is correct. Worth noting in the release notes that any third-party plugin or custom extension that implemented the FessConfig interface and overrode this method will get a compile error on upgrade. The feat! commit type signals the break, but a short note in the migration guide alongside login.required=true would help plugin authors triage the error quickly.

[marevol]

Thanks — labeled breaking, so the release notes will cover this, including the removed FessConfig getters.