Point catalog-api at the classic-models Keycloak realm, drop separate MCP hostname

MCP now shares the REST hostname (routed by path), matching the
/catalog/v1 rework — no second TLS listener/certificate needed.

kong/mcp/routes.yaml

@@ -10,7 +10,7 @@ spec:
       name: ${NAME}-catalog-mcp
   name: catalog-mcp
   hosts:
-    - ${MCP_HOSTNAME}
+    - ${REST_HOSTNAME}
   methods:
     - POST
     - DELETE
@@ -32,7 +32,7 @@ spec:
       name: ${NAME}-catalog-mcp
   name: catalog-mcp-stream
   hosts:
-    - ${MCP_HOSTNAME}
+    - ${REST_HOSTNAME}
   methods:
     - GET
   paths: