[Ticket]: Decide whether prod needs federation.discovery_url

### Type
Spike / Investigation

### Summary
Determine whether prod should set `federation.discovery_url`, and record the decision.

### Intent
So the identity/location split is a conscious choice in prod rather than an unexamined default.

### Source of truth (links)
- ADR-0025 and its amendment
- `docs/auth-reference.md`, 'Identity vs. location'
- `.docker/authz/container.yaml` (local example where the two diverge)

### Current Behavior
Prod sets only `federation.issuer`, so discovery defaults to dialling the public URL from inside the cluster. This works today but is undocumented as a decision.

### Expected Behavior
A recorded decision: either an in-cluster discovery URL is configured, or it is documented why the public URL is correct.

### Acceptance Criteria
- [ ] Confirmed whether the cluster can reach the public issuer, and by what path
- [ ] Decision recorded in the values file as a comment, not only in this ticket
- [ ] If a split is adopted, `iss` remains the PUBLIC issuer - only the dial target changes

### Out of Scope
Changing the issuer identity, which would invalidate every live token.

### Technical Context
Local Compose already demonstrates the divergence: `issuer: localhost:9100`, `discovery_url: keycloak:9100`.

### Risks
Confusing identity with location breaks either token validation or the browser redirect. ADR-0025's amendment exists because this was already gotten wrong once.

### Test Plan
Confirm from inside a pod which URLs resolve; verify discovery succeeds under whichever option is chosen.

### Verification evidence
- [ ] Test added and proven to fail before the change
- [ ] `just all-checks` green
- [ ] Every new or changed `src` file is <= 200 LoC

### Human accountable owner
@stephane-segning

### AI Usage Declaration
Ticket drafted with AI assistance from a verified repo audit.
Structure and estimates drafted with AI from a verified repository audit (file
line counts, config keys, and dependency state were read from the actual tree,
not assumed). A human owns intent, scope, and the release commitment.

### Human verification completed
- [ ] I can explain this work without referring to the AI-generated text
- [ ] Acceptance criteria are testable
- [ ] Source of truth is a real link, not boilerplate

Governance: https://adorsys-gis.github.io/ai-governance/

Start with ADR-0025 and its amendment, docs/auth-reference.md under 'Identity vs. location', and .docker/authz/container.yaml for the local issuer/discovery_url split. Confirm from inside a prod pod whether the public issuer is reachable and how discovery behaves. Done means the decision is recorded as a comment in the values file, discovery is verified, and iss remains the public issuer if a split is adopted.

Written by the indexing model from the issue text.