Rename the supply agent everywhere it is named

Its Keycloak client, audience scope, client-secret key, workflow names and file
names, and the A2A card. Kafka moved first, under its own account and consumer
group.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

deploy/agent-secrets.yaml

@@ -18,7 +18,7 @@ spec:
   target:
     name: n8n-agent-secrets
   data:
-    - secretKey: APPROVISIONNEMENT_CLIENT_SECRET
+    - secretKey: SUPPLY_CLIENT_SECRET
       remoteRef:
         key: keycloak/classic-models-realm
-        property: KC_SECRET_CLASSIC_MODELS_AGENT_APPROVISIONNEMENT
+        property: KC_SECRET_CLASSIC_MODELS_AGENT_SUPPLY