fix: pin a Kafka version the operator supports, and add the API's producer

Strimzi 1.2.0 supports 4.2.0 through 4.3.1; the manifest still asked for 4.1.0,
so the cluster sat NotReady with the reason only visible in the Kafka CR's
status — the operator logs said nothing. Pinned to 4.3.1, and metadataVersion
removed rather than guessed: the operator derives it, and a stale spelling there
is the same failure one release later.

Adds a KafkaUser for classic-models-api: Write and Describe on the
classic-models. prefix, and no Read. It publishes domain events and consumes
nothing, and a producer that can read every topic exfiltrates every other
domain's events if it is ever compromised.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

kafka-users.yaml

@@ -52,3 +52,30 @@ spec:
         operations:
           - Describe
           - Write
+---
+# The classic-models API, which publishes domain events and consumes nothing.
+#
+# Write-only and topic-scoped: a producer that can also read every topic is a
+# producer that can exfiltrate every other domain's events if it is ever
+# compromised. Describe is needed for metadata; it does not grant reads.
+apiVersion: kafka.strimzi.io/v1
+kind: KafkaUser
+metadata:
+  name: classic-models-api
+  namespace: kafka
+  labels:
+    strimzi.io/cluster: kafka
+spec:
+  authentication:
+    type: scram-sha-512
+  authorization:
+    type: simple
+    acls:
+      - resource:
+          type: topic
+          name: classic-models.
+          patternType: prefix
+        operations:
+          - Write
+          - Describe
+