fix(kong): render API credentials before startup

[birdmanmandbir]

Summary

• render the Kong declarative credential template inside the container before startup
• point Kong at the rendered file so key-auth accepts the actual anon and service-role keys
• add a deployment contract regression test

Security impact

Before this fix, Kong used predictable template literals as both anonymous and service-role key-auth credentials. The service-role credential can bypass normal row-level access controls, so affected clusters should deploy this fix promptly.

Root cause

The credential ConfigMap is a template, but the Kong container started directly without rendering it. Environment variables supplied from the JWT Secret therefore never reached Kong declarative configuration.

Verification

• go test ./...
• runtime render probe against the live Kong image: both placeholders removed without printing either credential
• live reproduction confirmed both predictable credentials are currently accepted; the corrected deployment will be re-tested after rollout