Fix callWithToken visibility and ServiceAccountToken tests

- Change callWithToken() from protected to public (required for external access)
- Protected visibility triggered __call() magic method causing type errors
- Add "Internal use only" warning to docblock
- Add bootstrap token setup to ServiceAccountTokenIntegrationTest
- All three ServiceAccountToken integration tests now pass

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com>

Author: cuppett

src/Traits/Cluster/MakesHttpCalls.php

@@ -193,13 +193,13 @@ protected function makeRequest(string $method, string $path, string $payload = '
      *
      * WARNING: This method temporarily mutates instance authentication state and is NOT safe
      * for concurrent or async use (e.g., ReactPHP, Amp, Swoole). Only use in synchronous,
-     * single-threaded contexts.
+     * single-threaded contexts. Internal use only.
      *
      * @return \Psr\Http\Message\ResponseInterface
      *
      * @throws \RenokiCo\PhpK8s\Exceptions\KubernetesAPIException
      */
-    protected function callWithToken(string $token, string $method, string $path, string $payload = '', array $query = ['pretty' => 1], array $options = [])
+    public function callWithToken(string $token, string $method, string $path, string $payload = '', array $query = ['pretty' => 1], array $options = [])
     {
         // Temporarily store current authentication state
         $originalToken = $this->token;

tests/Auth/ServiceAccountTokenIntegrationTest.php

@@ -31,6 +31,9 @@ private function isClusterAvailable(): bool
 
     public function test_service_account_token_request()
     {
+        // Set up bootstrap credentials (kubectl proxy accepts any token)
+        $this->cluster->withToken('bootstrap-token');
+
         // Create test service account
         $sa = $this->cluster->serviceAccount()
             ->setName('test-token-requester')
@@ -67,6 +70,9 @@ public function test_service_account_token_request()
 
     public function test_service_account_token_with_audiences()
     {
+        // Set up bootstrap credentials (kubectl proxy accepts any token)
+        $this->cluster->withToken('bootstrap-token');
+
         $sa = $this->cluster->serviceAccount()
             ->setName('test-token-audience')
             ->setNamespace('default')
@@ -89,14 +95,18 @@ public function test_service_account_token_with_audiences()
 
     public function test_convenience_method_with_service_account_token()
     {
+        // Set up bootstrap credentials for service account creation
+        $this->cluster->withToken('bootstrap-token');
+
         $sa = $this->cluster->serviceAccount()
             ->setName('test-convenience-sa')
             ->setNamespace('default')
             ->createOrUpdate();
 
         try {
-            // Use convenience method
+            // Use convenience method (need bootstrap token for TokenRequest API)
             $newCluster = KubernetesCluster::fromUrl('http://127.0.0.1:8080')
+                ->withToken('bootstrap-token')
                 ->withServiceAccountToken('default', 'test-convenience-sa', 1800);
 
             $token = $newCluster->getAuthToken();