Remove App Kubernetes bearer admission and retired token settings - #16383

The App now accepts operator OIDC cookies and ID-token bearers only. Remove its token_subjects and token_audience settings, TokenReview admission/fallback, token caller kind and unused Kubernetes auth client. A Kubernetes bearer receives 401 without an API review. Update the authentication docs/diagrams and convert accepted test callers to signed operator ID tokens, retaining denial and browser-session requirements.

Merge only after Flux has applied #16372's config to staging, and #16381's audience omission. Claude will verify this gate. #16372 alone still renders token_audience: agentplane, which this strict loader rejects. #16381 merged and this PR is rebased onto it; the deployment gate still requires Flux to apply both omissions.

Deliberately leaves out the agentplane-agent ServiceAccount and its token-request RBAC. Those go in a separate later PR after this code removal is pinned and no caller remains. Also leaves the App's outbound backend bearer files and service-to-service stages 4–5 to their image-pin gates. No stored Session/attachment shape changes or token provisioning.

Caller audit (repository-wide searches for the account, audience/subjects, TokenRequest/workload-token creation and bearer presentation, followed through the token sources):

• No remaining production, live-suite, script or Haku caller mints/presents the special App ServiceAccount token. Stop live tests minting the app agent token #16347 removed live minting. suites/live/conftest.py reads caller-supplied AGENTPLANE_SYSTEM_TEST_TOKEN; live test_thread_latency.py and app/testing/client.py present it. The shared-cluster allocator's remaining _token is for its observer Kubernetes account and only the Kubernetes API.
• The real remaining accepted test caller was app/integration_fixtures.py:agent_auth, consumed by test_api.py, test_thread_debug.py and test_notifications_stream.py. This PR replaces it with operator_auth, signed by the same mock OIDC issuer used for browser login. The notification stream still refuses an operator bearer without a browser session (403).
• Go route fixtures in runnerapi_test.go, appconfigapi_test.go, statusapi_test.go, sessionapi_test.go, threadreadapi_test.go and streamapi_test.go synthesized successful TokenReviews. These now use a shared signed operator ID-token fixture. Remove the unused policyapi_test.go reviewer as well. Auth unit tests retain wrong issuer/key/audience/expiry denial and explicit Kubernetes/opaque bearer rejection.
• Remaining inbound Kubernetes-token presentation is intentional negative coverage: integration_fixtures.py:kubernetes_auth mints a generic test-agent token for test_api.py:test_protected_go_routes_reject_kubernetes_bearer, expecting 401. Go stream tests send an invalid opaque workload bearer and expect 401; auth unit tests sign Kubernetes-shaped claims and expect 401. app/testing/test_client.py uses an opaque transport-fixture bearer against its own fake HTTP server, not an App receiver.
• k3s suites (deployment/stack.py, including MCP cleanup in test_delegation.py and suites/pod_cases.py) already use expiring test-issued operator OIDC tokens from OperatorTokens/Dex. They do not need App Kubernetes admission. The earlier Omit the App token subject allowlist from deployed settings #16372 sampler-roll failure was independent root-key rotation in the test PKI (fixed by Preserve system-test root keys across certificate reissuance #16377); its deployment already omitted token_subjects, and its App caller already used an operator ID token.
• app/testing/gateway_fixtures.py, test_thread_browser.py and test_live.py still mint outbound App→Dispatcher/Gateway tokens; scenarios/session_deletion.py mints an App→History token. Their receivers are backend services, not the App, so they remain for the service-SVID caller cutover.
• The staging manifest still declares the intentionally retained agentplane-agent ServiceAccount. No manifest projects its token for App admission. Retained references in docs/adr_orchestration_v1.md are a rejected design; debug/rollout_403.md is historical incident evidence. The DAG remains until the final SA/RBAC removal. Current App auth docs are updated here.

Validation: pre-commit passed (including Gazelle, gofumpt and manifest validation). bbr test //agentplane/app/internal/auth:unit_test //agentplane/app/internal/settings:settings_test //agentplane/app/internal/auth:session_integration_test passed (3/3; bf2fe9a6-001b-4184-9f65-a2b8238dabab). The following invocation passed 11/11 tests and built/linted the three changed Python libraries (8cd91541-b5bf-488a-9001-3779077924c8):

bbr test //agentplane/app/internal/server:runnerapi_test //agentplane/app/internal/server:appconfigapi_test //agentplane/app/internal/server:statusapi_test //agentplane/app/internal/server:policyapi_test //agentplane/app/internal/server:sessionapi_test //agentplane/app/internal/server:threadreadapi_test //agentplane/app/internal/server:streamapi_test //agentplane/app:test_api //agentplane/app:test_thread_debug //agentplane/app:test_notifications_stream //agentplane/app:settings //agentplane/app:integration_fixtures //agentplane/app/testing:replication_process //agentplane/system_tests/deployment:test_render

bbr test //agentplane/system_tests/suites/mcp:test_services //agentplane/system_tests/suites/mcp:test_sampler_roll passed (2/2; 261.3s and 164.5s respectively; invocation 8d0e5e5b-7ee0-4b4f-a6f3-c7ea6d954b94). Initial iterations caught an unused settings-test import and the now-unused Kubernetes client constructor; both were removed before opening.

GitHub CI is green at e6c50462883b1cb5aa5006f3968333fe31329f3b: Bazel CI, pre-commit, Nix/import checks and visual review passed (run). Published visual review reports no visual changes across the 12 affected targets.

Rollback: revert this code PR and repin the preceding App image; keep the subject/audience omissions. Confirm App startup/readiness, operator OIDC login and ordinary API calls after Flux applies the rollback. If restoring the retired YAML keys, first restore/pin a loader accepting them. The Flux application gate itself has no system-test coverage.

Questions for Claude

Please verify both #16372 and #16381 have been applied by Flux to staging before merge. This additional audience omission is required by the current rendered config, beyond #16372's subject omission. SA/RBAC removal remains gated on the code image pin and no remaining caller.