You can resolve this issue with local builds:

1. Clone core via SSH (no token)

2. Run:

   mvn clean install

3. This installs core into your local Maven repository (~/.m2/repository)

4. Now api and web can reference it in pom.xml without touching GitLab or HTTP tokens.