[docs] Document ANTHROPIC_AUTH_TOKEN protection in API proxy isolation (#6414)

* docs: Document ANTHROPIC_AUTH_TOKEN protection in API proxy isolation

Update authentication-architecture.md to explicitly mention ANTHROPIC_AUTH_TOKEN
alongside ANTHROPIC_API_KEY in the security design warning. This reflects the
recent changes in PR #6410 that protect ANTHROPIC_AUTH_TOKEN through the same
credential isolation mechanism.

Related to commit 6d25856 (Protect `ANTHROPIC_AUTH_TOKEN` in AWF credential isolation paths).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Landon Cox <landon.cox@microsoft.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Author: 4 people

docs/authentication-architecture.md

@@ -133,7 +133,7 @@ agent:
 ```
 
 :::danger[Security design]
-API keys are intentionally excluded from the agent container environment. When `--enable-api-proxy` is set, `OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, and related keys are added to the excluded environment variables list in `docker-manager.ts`.
+API credentials are intentionally excluded from the agent container environment. The API proxy is always enabled, and `OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, `ANTHROPIC_AUTH_TOKEN`, and related credentials are added to the excluded environment variables list in `src/services/agent-environment/excluded-vars.ts`.
 :::
 
 ### 3. API proxy: credential injection layer