Report each client's effective access-token format and flag every client that inherits the server default.

Read-only and diagnostic-only: this task never mutates state, never raises on a flagged client, and never exits non-zero (so it is safe to run in operator CI).