docs(agent): document the mut_ user token the API now accepts

[mergify-ci-bot]

The API takes a third bearer credential that this page did not mention: Mergify's
own user tokens, prefixed mut_. Anyone holding one had nothing here telling them
it would work, and the caution box listing the endpoints that refuse a personal
access token said nothing about how those endpoints treat a user token.

Adds a short section for it — the prefix, that it comes from the OAuth 2.0 device
authorization grant, and that it resolves to the same person their dashboard
session resolves to, so holding one grants no access its owner does not already
have. The caution box now says the four application-key-only endpoints refuse a
user token just as they refuse a PAT.

Evidence: the engine's bearer scheme for these tokens, which looks a mut_* token
up and returns the same user a dashboard session does; and those four endpoints,
which enable the application-key auth methods and nothing else.

Open question: where a reader gets one. That the device authorization grant issues
it is as far as I could verify — nothing says what to run to start that flow, and
the CLI schema has no login command to point at, so somebody reading this section
still cannot obtain a token. If there is a front door for it, that is the sentence
to add.

[mergify]

Merge Protections

🟢 All 6 merge protections satisfied — ready to merge.

Show 6 satisfied protections

🟢 🤖 Continuous Integration

• all of:
  • check-success = build
  • check-success = lint
  • check-success = test
  • any of:
    • check-success = test-broken-links
    • label = ignore-broken-links
  • any of:
    • -head-repo-full-name~=^Mergifyio/
    • check-success=Cloudflare Pages

🟢 👀 Review Requirements

• any of:
  • #approved-reviews-by >= 2
  • author = dependabot[bot]
  • author = renovate[bot]
  • all of:
    • -head ~= ^docs-agent/
    • author = mergify-ci-bot

🟢 Enforce conventional commit

Make sure that we follow https://www.conventionalcommits.org/en/v1.0.0/

• title ~= ^(fix|feat|internal|docs|style|refactor|perf|test|build|ci|chore|revert|ui)(?:\(.+\))?!?:

🟢 🔎 Reviews

• #changes-requested-reviews-by = 0
• #review-requested = 0
• #review-threads-unresolved = 0

🟢 📕 PR description

• body ~= (?ms:.{48,})

🟢 🚦 Auto-queue

When all merge protections are satisfied, this pull request will be queued automatically.

[mergify-ci-bot]

🤖 I read this review and pushed a new revision.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-09-03 07:43 UTC · Rule: default · triggered by merge protections
• ✅ Checks passed · on draft merge queue: checking #12658 on main (82fa6ed), stacked on #12659 #12667
• ✅ Merged — 2026-09-03 07:47 UTC · at 98769da86d0ca6e754e76869420d96b1a06abae4 · squash

This pull request spent 4 minutes 5 seconds in the queue, including 2 minutes 58 seconds running CI.

Required conditions to merge

• github-review-approved [🛡 GitHub repository ruleset rule Require pull request for default branch]
  • docs(agent): document the mut_ user token the API now accepts #12658
• schedule=Mon-Fri 09:00-17:30[Europe/Paris]
• all of [🛡 Merge Protections rule Enforce conventional commit]:
  • title ~= ^(fix|feat|internal|docs|style|refactor|perf|test|build|ci|chore|revert|ui)(?:\(.+\))?!?:
    • docs(agent): document the mut_ user token the API now accepts #12658
• all of [🛡 Merge Protections rule 👀 Review Requirements]:
  • any of:
    • #approved-reviews-by >= 2
      • docs(agent): document the mut_ user token the API now accepts #12658
    • author = dependabot[bot]
      • docs(agent): document the mut_ user token the API now accepts #12658
    • author = renovate[bot]
      • docs(agent): document the mut_ user token the API now accepts #12658
    • all of:
      • -head ~= ^docs-agent/
        • docs(agent): document the mut_ user token the API now accepts #12658
      • author = mergify-ci-bot
        • docs(agent): document the mut_ user token the API now accepts #12658
• all of [🛡 Merge Protections rule 📕 PR description]:
  • body ~= (?ms:.{48,})
    • docs(agent): document the mut_ user token the API now accepts #12658
• all of [🛡 Merge Protections rule 🔎 Reviews]:
  • #changes-requested-reviews-by = 0
    • docs(agent): document the mut_ user token the API now accepts #12658
  • #review-requested = 0
    • docs(agent): document the mut_ user token the API now accepts #12658
  • #review-threads-unresolved = 0
    • docs(agent): document the mut_ user token the API now accepts #12658
• all of [🛡 Merge Protections rule 🤖 Continuous Integration]:
  • all of:
    • check-success = build
    • check-success = lint
    • check-success = test
    • any of:
      • check-success = test-broken-links
      • label = ignore-broken-links
        • docs(agent): document the mut_ user token the API now accepts #12658
    • any of:
      • -head-repo-full-name~=^Mergifyio/
        • docs(agent): document the mut_ user token the API now accepts #12658
      • check-success=Cloudflare Pages