docs(plans): require service_token when the gitlab_api block is present

One-line design amendment adopted from the AppSec review on !1669: service_token becomes schema-required when the gitlab_api block is present (protovalidate, the iam.service_token precedent), so a token-less block fails at load instead of relying on the wiring's no-source arm. !1669 (merged) already implements this shape.

Related to #356 (closed)