# 1. no credentials (a plain RestClient)
whoAmI() -> 401 Unauthorized, WWW-Authenticate: Bearer realm="stub"

# 2. bearer token added by a ClientHttpRequestInterceptor on the "bearer" group
whoAmI() -> {caller=demo-user, tokenKind=static}
headers the upstream saw: Authorization=Bearer <redacted>, X-Correlation-Id present=true (8 chars)

# 3. API key from spring.http.serviceclient.apikey.default-header.X-Api-Key (no Java at all)
whoAmI() -> {caller=demo-service, auth=api-key}
headers the upstream saw: X-Api-Key=demo-key-123, X-Correlation-Id present=true

# 4. the interceptor is per group: the "apikey" group never sends Authorization
Authorization header on the apikey group: null