Point catalog-api at the classic-models Keycloak realm, drop separate MCP hostname

MCP now shares the REST hostname (routed by path), matching the
/catalog/v1 rework — no second TLS listener/certificate needed.

dev/flux-kustomization.yaml

@@ -19,7 +19,7 @@ spec:
       NAMESPACE: catalog
       CONTROL_PLANE_REF_NAME: catalog-dev-bkphl
       BACKEND_HOST: classic-models-api.classic-models.svc.cluster.local
-      OIDC_ISSUER: https://keycloak.sttlab.eu/realms/sttlab
+      OIDC_ISSUER: https://keycloak.sttlab.eu/realms/classic-models
       API_AUDIENCE: '["catalog-api"]'
       API_SCOPES_REQUIRED: '["catalog:read"]'
       BACKEND_AUDIENCE: '["classic-models-api"]'
@@ -27,7 +27,6 @@ spec:
       API_RATE_LIMIT_MINUTE: "60"
       AUDIT_LOG_ENDPOINT: http://audit-log-collector.observability.svc.cluster.local/logs
       REST_HOSTNAME: catalog-dev.sttlab.local
-      MCP_HOSTNAME: catalog-mcp-dev.sttlab.local
       MCP_AUDIENCE: '["mcp-catalog"]'
       TOKEN_EXCHANGE_CLIENT_ID: kong-token-exchange-broker
     substituteFrom:

kong/mcp/routes.yaml

@@ -10,7 +10,7 @@ spec:
       name: ${NAME}-catalog-mcp
   name: catalog-mcp
   hosts:
-    - ${MCP_HOSTNAME}
+    - ${REST_HOSTNAME}
   methods:
     - POST
     - DELETE
@@ -32,7 +32,7 @@ spec:
       name: ${NAME}-catalog-mcp
   name: catalog-mcp-stream
   hosts:
-    - ${MCP_HOSTNAME}
+    - ${REST_HOSTNAME}
   methods:
     - GET
   paths: