fix: REST client BASIC auth uses Rest\$ConstantValue with correct BSON key (#200)

Three root causes found and fixed:

1. Studio Pro requires Rest\$ConstantValue for BASIC auth credentials,
   not Rest\$StringValue. Using StringValue causes InvalidCastException
   when opening the document and 401 at runtime because the auth header
   is never sent.

2. The BSON field name for the constant reference is "Value" (matching
   the metamodel), not "Constant" (which was an incorrect guess). With
   the wrong key, Mendix can't resolve the constant → CE7073.

3. When literal strings are provided for auth credentials (e.g.,
   Password: 'secret'), the executor now auto-creates string constants
   (Module.ClientName_Username / _Password) so the BSON always contains
   Rest\$ConstantValue references. This is transparent to the user.

Also adds missing ExportLevel, Tags, Timeout, BaseUrlParameter, and
OpenApiFile fields that Studio Pro always populates on REST clients.

Test case: mdl-examples/bug-tests/200-basic-auth-rest-client.mdl
creates a REST client pointing at httpbin.org/basic-auth with a test
page for side-by-side comparison of REST client auth vs inline REST
CALL auth.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: ako

mdl-examples/bug-tests/200-basic-auth-rest-client.mdl

@@ -42,7 +42,7 @@ CREATE CONSTANT AuthTest.ApiPass TYPE String DEFAULT 'testpass123!';
 
 CREATE REST CLIENT AuthTest.HttpBinAuthAPI (
   BaseUrl: 'https://httpbin.org',
-  Authentication: BASIC (Username: $ApiUser, Password: $ApiPass)
+  Authentication: BASIC (Username: @AuthTest.ApiUser, Password: @AuthTest.ApiPass)
 )
 {
   /** Calls /basic-auth/testuser/testpass123! — returns 200 if auth header sent */

mdl/executor/cmd_rest_clients.go

@@ -120,8 +120,10 @@ func outputConsumedRestServiceMDL(ctx *ExecContext, svc *model.ConsumedRestServi
 	if svc.Authentication == nil {
 		fmt.Fprintln(w, "  Authentication: NONE")
 	} else {
-		fmt.Fprintf(w, "  Authentication: BASIC (Username: '%s', Password: '%s')\n",
-			svc.Authentication.Username, svc.Authentication.Password)
+		username := formatRestAuthValue(svc.Authentication.Username)
+		password := formatRestAuthValue(svc.Authentication.Password)
+		fmt.Fprintf(w, "  Authentication: BASIC (Username: %s, Password: %s)\n",
+			username, password)
 	}
 	fmt.Fprintln(w, ")")
 	fmt.Fprintln(w, "{")
@@ -545,9 +547,10 @@ func dropRestClient(ctx *ExecContext, stmt *ast.DropRestClientStmt) error {
 }
 
 // formatRestAuthValue formats an authentication value for MDL output.
+// Constant references (stored with $ prefix internally) are emitted as @Module.Constant.
 func formatRestAuthValue(value string) string {
 	if strings.HasPrefix(value, "$") {
-		return value
+		return "@" + strings.TrimPrefix(value, "$")
 	}
 	return "'" + value + "'"
 }

mdl/grammar/MDLParser.g4

@@ -2427,7 +2427,8 @@ createRestClientStatement
 
 restClientProperty
     : identifierOrKeyword COLON STRING_LITERAL                       // BaseUrl: '...', Username: '...'
-    | identifierOrKeyword COLON VARIABLE                             // Username: $Constant (stored as Rest$ConstantValue)
+    | identifierOrKeyword COLON VARIABLE                             // Username: $Constant (legacy, stored as Rest$ConstantValue)
+    | identifierOrKeyword COLON AT qualifiedName                     // Username: @Module.Constant (preferred Mendix convention)
     | identifierOrKeyword COLON NONE                                 // Authentication: NONE
     | identifierOrKeyword COLON BASIC LPAREN restClientProperty (COMMA restClientProperty)* RPAREN
     ;