fix: attach Builder authtoken to AuthInterceptor and prevent duplicate authtoken headers

Two related authentication bugs:

1. Contentstack.Builder.setAuthtoken() stored the token on the client but
   never wired it into AuthInterceptor - only login() did. Clients built
   via setAuthtoken() silently sent no authtoken header at all; requests
   only worked when an authorization (management token) header masked it.

2. AuthInterceptor used addHeader(), so requests that already carried an
   explicit authtoken (e.g. via @HeaderMap) received a duplicate header
   and were rejected as unauthenticated. The client-level token is now
   attached only when the request does not already have one.

Author: aniket-shikhare-cstk

src/main/java/com/contentstack/cms/Contentstack.java

@@ -1059,8 +1059,12 @@ private OkHttpClient httpClient(Contentstack contentstack, Boolean retryOnFailur
                 // Add interceptor to handle OAuth, token refresh, and retries
                 builder.addInterceptor(this.oauthInterceptor);
             } else {
-                this.authInterceptor = contentstack.interceptor = new AuthInterceptor();
-                
+                // Wire the Builder's authtoken into the interceptor so that
+                // clients built via setAuthtoken(..) actually authenticate.
+                // (Previously only login() set it, so setAuthtoken-built clients
+                // silently sent no authtoken header at all.)
+                this.authInterceptor = contentstack.interceptor = new AuthInterceptor(this.authtoken);
+
                 // Configure early access if needed
                 if (this.earlyAccess != null) {
                     this.authInterceptor.setEarlyAccess(this.earlyAccess);

src/main/java/com/contentstack/cms/core/AuthInterceptor.java

@@ -86,7 +86,10 @@ public Response intercept(Chain chain) throws IOException {
             request.header(Util.CONTENT_TYPE, Util.CONTENT_TYPE_VALUE);
         }
 
-        if (this.authtoken != null) {
+        // Attach the client-level authtoken only when the request doesn't already
+        // carry one (e.g. via @HeaderMap) - addHeader would APPEND a duplicate
+        // authtoken header and the API rejects the request as unauthenticated.
+        if (this.authtoken != null && originalRequest.header(Util.AUTHTOKEN) == null) {
             request.addHeader(Util.AUTHTOKEN, this.authtoken);
         }