Deploy workforce/dev dataplane (Layer 2), mirroring the other domains

Real Konnect Control Plane 1dbd741c-0da2-4718-8c72-6f479530b371, PAT
in Vault. Replaces the TODO stubs with the proven three-file
pattern. JWT_AUDIENCE_WHITELIST includes mcp-workforce from the
start since Layer 3 was built the same session — see STATUS.md
section 23.

dev/api-gateway/externalsecret.yaml

@@ -0,0 +1,22 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: workforce-dev-konnect-auth
+  namespace: workforce
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-kong-v2
+  target:
+    name: workforce-dev-konnect-auth
+    template:
+      metadata:
+        labels:
+          konghq.com/credential: konnect
+          konghq.com/secret: "true"
+  data:
+    - secretKey: token
+      remoteRef:
+        key: kong-v2/workforce/dev/konnect-pat
+        property: token