Add Backstage service-to-service auth requirement to .fullsend/AGENTS.md

What happened

On PR #3476, the code agent created a CodeCoverageClient that calls the code-coverage-backend plugin API using bare fetch() without Backstage service-to-service authentication. The review agent flagged this as medium severity on 2026-06-19 and escalated to high severity on 2026-06-22, noting it would fail at runtime in any deployment with default auth settings. The human then directed the fix agent on 2026-07-27 to add AuthService with getOwnServiceCredentials() and getPluginRequestToken(). The fix was implemented in commit ad65b31. A sibling issue #3473 (codecov module) will require the same pattern, suggesting this will recur.

What could go better

The code agent should have included Backstage service-to-service authentication from the start. This is a standard Backstage requirement for backend modules that call other plugin APIs — the discovery service resolves internal URLs, and the auth service provides tokens. The issue description even specified the API endpoint format, which implies an internal plugin-to-plugin call. The code agent likely missed this because .fullsend/AGENTS.md has no mention of Backstage auth patterns, and the pattern requires injecting coreServices.auth into the module's dependency list. Confidence is high — this is a well-documented Backstage requirement, the review agent correctly identified it, and the same pattern will be needed for at least one more planned module (#3473).

Proposed change

Add a Backstage-specific instruction to .fullsend/AGENTS.md: When creating a backend module or plugin that calls another Backstage plugin's API (e.g., via DiscoveryService.getBaseUrl()), always include service-to-service authentication. Inject coreServices.auth into the module dependencies, call auth.getOwnServiceCredentials() to get the caller identity, then auth.getPluginRequestToken({ onBehalfOf: credentials, targetPluginId: '<plugin>' }) to get a token, and include it as Authorization: Bearer *** in the fetch headers. Reference existing modules like scorecard-backend-module-code-coverage` as examples.

Validation criteria

The next agent-authored PR that creates a backend module calling another Backstage plugin's API (such as the codecov module from #3473) should include service-to-service authentication in the initial code agent commit, without requiring a review finding or /fs-fix command to add it.

Generated by retro agent from https://github.com/redhat-developer/rhdh-plugins/pull/3476

Read .fullsend/AGENTS.md and compare the service-to-service authentication pattern in scorecard-backend-module-code-coverage. Add the Backstage guidance for backend modules calling another plugin API, including the required auth services, credentials, token, and request header; done means future agent-authored modules include this pattern without review fixes.