Kafka gateway: Kafka SASL authentication bridge to Iggy users

Part of #3560.

## Summary

Map Kafka **SaslHandshake (17)** and **SaslAuthenticate (36)** to Iggy authentication.

## Open question (from discussion #3253)

- One-to-one SASL user → Iggy user mapping?
- Or shared `kafka-bridge` service account?

## Depends on

- #3539 — Phase 1

## Scope

- [ ] Document chosen auth model in ADR
- [ ] PLAIN / SCRAM (prioritize what Iggy supports)
- [ ] Map authenticated identity to Iggy SDK login
- [ ] ACL mapping to Iggy permissions (may split follow-up)

## Acceptance criteria

- [ ] Kafka client with SASL can produce/consume through gateway
- [ ] Unauthorized credentials rejected with Kafka error codes

## References

- Rollout plan: https://github.com/apache/iggy/discussions/3253#discussioncomment-17181030

Start by reading the Phase 1 dependency in #3539 and the rollout plan discussion linked from #3253, then review the relationship to #3560. The work is complete when an auth model is documented, supported SASL flows map identities to Iggy authentication and permissions, and the stated Kafka acceptance criteria pass.

Written by the indexing model from the issue text.