NPE in HttpClientAdapter when apikey auth placement is not set

[eskenazit]

Component

Core Engine

Description

Actual behavior:
When an apikey authentication spec does not include a placement field, HttpClientAdapter.setChallengeResponse() throws a NullPointerException:

java.lang.NullPointerException: Cannot invoke "String.equals(Object)" because "placement" is null
  at io.naftiko.engine.consumes.http.HttpClientAdapter.setChallengeResponse(HttpClientAdapter.java:131)

Expected behavior:
A clear IllegalArgumentException indicating that placement is required for apikey authentication (e.g. "placement is required for apikey authentication (expected: header or query)").

Steps to Reproduce

1. Define a consumes block with authentication.type: apikey and omit placement
2. Call any tool that routes to this client
3. NPE is thrown in HttpClientAdapter.setChallengeResponse()

Capability File (if relevant)

authentication:
      type: apikey
      key: X-Dock-Key
      value: MY_API_KEY
      # placement missing

Logs & Stacktrace

java.lang.NullPointerException: Cannot invoke "String.equals(Object)" because "placement" is null
      at io.naftiko.engine.consumes.http.HttpClientAdapter.setChallengeResponse(HttpClientAdapter.java:131)

Version

1.0.0-alpha1

Runtime

JVM

Agent Context (optional)

llm: claude-sonnet-4-5
discovery_method: runtime_observation
files_suspected:
  - io/naftiko/engine/consumes/http/HttpClientAdapter.java