refactor: rename the token-exchange broker to drop the middleware's name

Every agent has to name this client in the audience scopes it requests, so the
one thing an agent cannot avoid naming was the very thing it should know
nothing about. The gateway is replaceable; the contract should not say
otherwise.

token-exchange-broker, same credential, same behaviour. The old client stays in
the realm until every consumer has moved.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

dev/flux-kustomization.yaml

@@ -31,7 +31,7 @@ spec:
       # record `sales` and turns that into the Loki label domain=sales.
       AUDIT_LOG_ENDPOINT: http://audit-log-collector.observability.svc.cluster.local/sales
       REST_HOSTNAME: sales-dev.sttlab.local
-      TOKEN_EXCHANGE_CLIENT_ID: kong-token-exchange-broker
+      TOKEN_EXCHANGE_CLIENT_ID: token-exchange-broker
     substituteFrom:
       - kind: Secret
         name: sales-token-exchange-broker