Answer
OAuth2 is only applicable to projections accessed through the MAIN cluster — when accessing a projection endpoint on the INTEGRATION cluster specifically, Basic Authentication is required instead, regardless of whether a valid OAuth2 token has been obtained. This is why the exact same OAuth2 Bearer token that would work against a main-cluster endpoint returns 401 when used against an integration-cluster endpoint for the same projection.