docs(auth): document GLAB_IS_OAUTH2 and the environment token scheme

What does this MR do and why?

Documents GLAB_IS_OAUTH2 and the auth scheme a token from the environment gets. This is suggestion 3 of #8482, the only part of that issue still unaddressed. Documentation only — NewClientFromConfig is untouched.

A token supplied through GITLAB_TOKEN or GITLAB_ACCESS_TOKEN is sent as a personal access token even when the host is configured for OAuth, and GLAB_IS_OAUTH2=true is the only way to override that. None of this was written down anywhere a user would look: GLAB_IS_OAUTH2 appeared only in internal/config/schema.go, absent from the environment variable table and from the authentication page.

Two reporters have now hit it — the Duo Agent Platform case that opened #8482, and a wrapper script re-exporting glab config get token (#8482, 2026-08-25). Both were fixed by setting a variable neither reporter could have discovered from the documentation.

Changes

• docs/source/authentication.md — new Token from an environment variable section: the default scheme, the variable that changes it, that the rule applies even to a token glab stored itself, and why a copied OAuth access token cannot be refreshed in place.
• internal/commands/root.go — GLAB_IS_OAUTH2 in the root command's environment help, which feeds the generated table in docs/source/_index.md (regenerated with make gen-docs).

Relationship to !3670 (merged) and !3784 (closed)

!3670 (merged) closed suggestion 1 of the issue: internal/api/oauth_provenance_test.go pins the provenance matrix, and glab auth status names the mismatch on a 401. This MR is the documentation ask.

!3784 (closed) proposed suggestion 2, keeping a stored is_oauth2 when the environment token is byte-identical to the stored one. It is closed and unmerged, so the wording here describes main's behaviour, not !3784 (closed)'s — every environment token is a PAT unless GLAB_IS_OAUTH2 says otherwise, including one glab stored itself. If suggestion 2 later lands, the "including one that glab stored itself" paragraph and the re-export example are what change.

Verification

make gen-docs                # docs/source/_index.md regenerated, committed
markdownlint-cli2 docs/...   # 0 errors
vale --minAlertLevel error   # 0 errors
lefthook run pre-push        # all green, including check-generated