ateapi: make the actor JWT issuer configurable and add typ to the header - #1834

…entity docs (agent-substrate#2597)

Part of agent-substrate#1756.

**Why:** every install still has to set `actorIdentityJWTProvider`, and
`docs/authentication.md` says it decides who may mint actor JWTs. It no
longer decides anything:

- agent-substrate#757 added it when minting lived in a separate `ActorIdentity`
service. `MintJWT` refused any caller whose JWT came from a different
provider's issuer, which in practice limited minting to atelet's
Kubernetes service account tokens.
- agent-substrate#1315 moved minting into `ateapi.Control` and dropped that check,
leaving caller limits to the authz framework.
- agent-substrate#1834 removed the last code that read the provider's issuer.

So ate-api-server requires a field and fails to start if it names a
missing provider, yet nothing uses it, and the docs say it decides who
may mint, which authorization now decides. Section 7 of
`docs/api-guide.md` still describes the old service and its atelet-only
rules.

**What changes:**

- `actorIdentityJWTProvider` is gone from ate-api-server's
authentication config, and ate-setup stops writing it.
- `docs/authentication.md` drops it and keeps the pointer to
`authorization.md` for what a caller may do.
- Section 7 of `docs/api-guide.md` now describes `MintActorJwt` and
`MintActorCertificate` on `ateapi.Control`, who may call them, their
fields, and the JWT's claims, instead of the old service, its caller
checks, and a wrong SPIFFE path. The ADK paragraph, which pointed at the
same service, now describes the egress gateway attaching actor JWTs.

For reviewers: the config is parsed strictly and ate-setup only creates
`ate-api-authentication` when it's missing, so an existing install must
delete the `actorIdentityJWTProvider` line from that ConfigMap before
ate-api-server restarts on this version.

Testing: unit tests for the config loader and ate-setup's rendered
config. I didn't run e2e; CI's e2e installs a fresh kind cluster, so it
doesn't exercise the upgrade case.

- [ ] Tests pass
- [x] Appropriate changes to documentation are included in the PR