Deprecate and remove the admin token issuer proxy

Description

Deprecate the admin token issuer proxy and migrate its consumers to a supported replacement token-issuance flow. Remove the proxy only after the replacement is implemented, validated, and adopted in managed and self-hosted deployments.

The migration plan must preserve authentication and authorization behavior while eliminating the proxy as an installation, startup, and operational dependency.

Definition of Done

• Inventory proxy consumers, token flows, routes, scopes, configuration, health checks, and deployment dependencies.
• Define the replacement token-issuance contract and complete the required security review.
• Implement the replacement flow and migrate all supported consumers.
• Define and publish the deprecation timeline, compatibility window, and removal release.
• Validate backward compatibility during migration and provide clear failure behavior for unsupported configurations.
• Verify token lifetime, scope, audience, revocation, and least-privilege behavior in the replacement flow.
• Remove the proxy Deployment, Service, routes, images, Helm values, RBAC, credentials, health checks, and monitoring after migration.
• Remove the proxy from managed and self-hosted installation and upgrade paths.
• Add end-to-end tests for fresh installation, upgrade, token issuance, authorization failures, and rollback.
• Decide whether the startup hardening tracked by #1229 is still required during migration and complete or supersede it accordingly.
• Update customer release notes, operator guidance, and troubleshooting documentation.

Resources (optional)

• #1229

By submitting this issue, you acknowledge that you are an assigned member of the NVCF development team and agree to follow our code of conduct and our contributing guidelines.