feat(page-scanner): migrate API URL and auth token config from env vars to dotCMS App

[fmontes]

Summary

The PageScannerResource currently reads its two required configuration values — the upstream API URL and auth token — directly from environment variables / dotmarketing-config.properties via Config.getStringProperty(). This approach:

• Requires server-level configuration changes to enable the feature
• Exposes the auth token as a plain environment variable or config file entry
• Provides no UI for admins to enable/disable or reconfigure the integration

These values should instead be managed through a dotCMS App (Apps portlet), which is the standard dotCMS pattern for third-party integrations requiring secrets.

Current Behavior

File: dotCMS/src/main/java/com/dotcms/rest/api/v1/pagescanner/PageScannerResource.java

// Lines 42–43
public static final String API_URL_PROPERTY        = "DOT_PAGE_SCANNER_API_URL";
public static final String API_AUTH_TOKEN_PROPERTY = "DOT_PAGE_SCANNER_API_AUTH_TOKEN";

// Lines 117–118
final String apiUrl       = Config.getStringProperty(API_URL_PROPERTY, DEFAULT_API_URL);
final String apiAuthToken = Config.getStringProperty(API_AUTH_TOKEN_PROPERTY, null);

If either value is missing, the endpoint returns 503 SERVICE_UNAVAILABLE.

Proposed Solution

1. Create a dotCMS App descriptor (YAML) for the Page Scanner integration with:

   • apiUrl — text field, default https://a11y.api.dotcms.site
   • apiAuthToken — secret field (masked in UI)

2. Update PageScannerResource to look up both values from the App's secrets store (via AppsAPI) instead of Config.getStringProperty()

3. Remove the DOT_PAGE_SCANNER_API_URL and DOT_PAGE_SCANNER_API_AUTH_TOKEN constants and all references to them

4. Update error messages that reference the old env var names

Acceptance Criteria

• A dotCMS App descriptor YAML exists for the Page Scanner integration
• The App exposes two fields: apiUrl (text) and apiAuthToken (secret)
• PageScannerResource reads both values from the App secrets store
• The old Config.getStringProperty() calls and env-var constants are removed
• When the App is not installed or not configured, the endpoints still return a meaningful 503 response
• No secrets are logged or exposed in error messages

References

• dotCMS/src/main/java/com/dotcms/rest/api/v1/pagescanner/PageScannerResource.java (lines 42–43, 117–126)