[Epic]: Platform hygiene and deprecation discipline

### Executive Summary
We want stale configuration to be impossible to ignore, because this repo has no `deny_unknown_fields` anywhere and a dead key sat in prod values unnoticed. This epic exists so config drift is loud rather than silent.

### Strategic Intent
Config that no longer does anything should say so. Silence is how a key survives three releases after the code that read it was deleted.

### Problem Statement
`relying_party.issuer` was removed in #504 and is still set in prod. Nothing warns, because unknown keys are silently dropped workspace-wide. The same silence would hide the next one.

### Desired Outcome
Unknown configuration keys produce a startup warning naming the key; the known dead key is removed from prod; the discovery-URL question is decided and written down.

### Scope (In / Out)
**In:**
- Warn-on-unknown-key at config load
- Removing the dead prod key once the shim and deploy are in place
- Deciding whether prod needs `federation.discovery_url`
- Root-causing the stack-wide container exit 137

**Out:**
- Hard-failing on unknown keys, which would break the retro-compat shim R1 depends on

### Source of truth (links)
- `ai-helm-values/environments/prod/values/lightbridge-app.yaml:983`
- ADR-0025 and its amendment (identity vs location)
- `crates/lightbridge-authz-core/src/config/mod.rs`

### Stakeholders
Platform team (4 advanced + 2 senior engineers), Scrum Master, prod operators.

### Key Assumptions
- Warning is the right severity while a deprecated key is deliberately accepted

### Constraints
- Must not conflict with the R1 retro-compat shim: a deprecated key warns, an unknown key warns, neither aborts

### Risks
- Warning on every unknown key could be noisy against charts that legitimately carry extra keys; scope the check to the parsed config tree

### Success metrics
- A stale key produces exactly one named warning at startup
- Prod values contain no keys the running binary does not read

### Child User Stories
Tracked as sub-issues of this epic.

### Human accountable owner
@stephane-segning

### AI Usage Declaration
Epic decomposition and estimation were AI-assisted.
Structure and estimates drafted with AI from a verified repository audit (file
line counts, config keys, and dependency state were read from the actual tree,
not assumed). A human owns intent, scope, and the release commitment.

### Human verification completed
- [ ] I can explain this work without referring to the AI-generated text
- [ ] Acceptance criteria are testable
- [ ] Source of truth is a real link, not boilerplate

Governance: https://adorsys-gis.github.io/ai-governance/