fix(api): retire Kong key-auth on model routes, it hard-blocks every Bearer client

Verified live: Authorization: Bearer <key> (what every OpenAI-SDK-compatible
client sends, pi included) gets 401 from this Kong key-auth config. A raw
apikey: <key> header succeeds. No such client lets you send a raw apikey
header or customize the auth header name, so key-auth here was blocking
100% of real usage, not just an edge case.

Comments out the model-key-auth KongPlugin and strips it from every route's
konghq.com/plugins annotation in llm-routes.yaml. KongConsumer/secret stay
defined so re-enabling later is cheap. Needs a real fix before going back on
(e.g. a request-transformer that copies the Bearer token into an apikey
header before key-auth runs) -- until then the model routes are
unauthenticated.

k8s/apps/api/llm-routes.yaml

@@ -66,7 +66,7 @@ metadata:
   name: llm-models
   namespace: llm-serving
   annotations:
-    konghq.com/plugins: llm-models-list,model-key-auth
+    konghq.com/plugins: llm-models-list # model-key-auth stripped -- see model-auth.yaml
     konghq.com/strip-path: "false"
     konghq.com/methods: "GET"
 spec:
@@ -110,7 +110,7 @@ metadata:
   name: llm-chat-reasoning
   namespace: llm-serving
   annotations:
-    konghq.com/plugins: llm-rewrite-reasoning,model-key-auth
+    konghq.com/plugins: llm-rewrite-reasoning # model-key-auth stripped -- see model-auth.yaml
     konghq.com/strip-path: "false"
     konghq.com/methods: "POST"
     konghq.com/connect-timeout: "10000"
@@ -152,7 +152,7 @@ metadata:
   name: llm-chat-ornith
   namespace: llm-serving
   annotations:
-    konghq.com/plugins: llm-rewrite-ornith,model-key-auth
+    konghq.com/plugins: llm-rewrite-ornith # model-key-auth stripped -- see model-auth.yaml
     konghq.com/strip-path: "false"
     konghq.com/methods: "POST"
     konghq.com/connect-timeout: "10000"
@@ -197,7 +197,7 @@ metadata:
   name: llm-chat-qwen
   namespace: llm-serving
   annotations:
-    konghq.com/plugins: llm-rewrite-qwen,model-key-auth
+    konghq.com/plugins: llm-rewrite-qwen # model-key-auth stripped -- see model-auth.yaml
     konghq.com/strip-path: "false"
     konghq.com/methods: "POST"
     konghq.com/connect-timeout: "10000"
@@ -267,7 +267,7 @@ metadata:
   name: llm-rerank
   namespace: llm-serving
   annotations:
-    konghq.com/plugins: llm-rewrite-rerank,model-key-auth
+    konghq.com/plugins: llm-rewrite-rerank # model-key-auth stripped -- see model-auth.yaml
     konghq.com/strip-path: "false"
     konghq.com/methods: "POST"
     konghq.com/connect-timeout: "10000"