refactor(realm): rename the token-exchange broker, drop the middleware's name

Every agent has to name this client in the audience scopes it requests, so the
one thing an agent could not avoid naming was the very thing it should know
nothing about. The gateway serving those URLs is replaceable; the contract
should not imply otherwise.

kong-token-exchange-broker becomes token-exchange-broker, same credential, same
behaviour. The rename was rolled out in order — new client alongside the old,
then the callers, then the gateways, then removal — so no call ever hit a realm
that had forgotten the name its caller was still using. Followed through the
client scope, the audience mappers, the fine-grained admin policy
allow-broker-client, and the roles map.

The Vault property keeps the old name. Renaming it there means re-issuing the
value to every gateway holding a copy, for no gain; the ExternalSecret maps it
to KC_SECRET_TOKEN_EXCHANGE_BROKER instead, so everything the cluster can see
is neutral.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

k8s/secrets/externalsecret-realm.yaml

@@ -19,3 +19,13 @@ spec:
     # Vault, with no edit here.
     - extract:
         key: keycloak/classic-models-realm
+  data:
+    # The token-exchange broker was renamed to drop the middleware's name from
+    # a contract every agent has to repeat. The Vault property still carries the
+    # old name — renaming it there means re-issuing the value to every gateway
+    # that holds a copy — so it is mapped here instead. Same secret, neutral
+    # name everywhere the cluster can see.
+    - secretKey: KC_SECRET_TOKEN_EXCHANGE_BROKER
+      remoteRef:
+        key: keycloak/classic-models-realm
+        property: KC_SECRET_KONG_TOKEN_EXCHANGE_BROKER