[Ticket]: Warn on unknown configuration keys instead of ignoring them

### Type
Technical debt

### Summary
Log a warning naming any key present in the loaded config that the binary does not read.

### Intent
So a stale key cannot survive unnoticed the way `relying_party.issuer` did.

### Source of truth (links)
- `crates/lightbridge-authz-core/src/config/mod.rs`
- `ai-helm-values/environments/prod/values/lightbridge-app.yaml:983`

### Current Behavior
`deny_unknown_fields` is used nowhere in the workspace, so unknown keys are silently dropped.

### Expected Behavior
Startup logs name every unrecognised key exactly once.

### Acceptance Criteria
- [ ] Each unknown key is named once, with its path
- [ ] Startup does NOT abort - hard-failing would break the R1 retro-compat shim
- [ ] Deprecated-but-accepted keys warn with their own message, distinct from unknown ones
- [ ] A test asserts a stale key produces exactly one warning and no failure

### Out of Scope
Hard-failing on unknown keys.

### Technical Context
Warn-not-fail is deliberate and coupled to R1's shim. Reconsider only once the deprecated key is actually removed.

### Risks
Over-warning against charts that legitimately carry extra keys will train operators to ignore the log. Scope the check to the parsed config tree.

### Test Plan
Unit test with a config containing one unknown and one deprecated key; assert two distinct warnings and a successful load.

### Verification evidence
- [ ] Test added and proven to fail before the change
- [ ] `just all-checks` green
- [ ] Every new or changed `src` file is <= 200 LoC

### Human accountable owner
@stephane-segning

### AI Usage Declaration
Ticket drafted with AI assistance from a verified repo audit.
Structure and estimates drafted with AI from a verified repository audit (file
line counts, config keys, and dependency state were read from the actual tree,
not assumed). A human owns intent, scope, and the release commitment.

### Human verification completed
- [ ] I can explain this work without referring to the AI-generated text
- [ ] Acceptance criteria are testable
- [ ] Source of truth is a real link, not boilerplate

Governance: https://adorsys-gis.github.io/ai-governance/