docs(weather-agent): demo-ui.md references obsolete keycloak-admin-secret in rossoctl-system

[pdettori]

Summary

authbridge/demos/weather-agent/demo-ui.md tells users to verify a
keycloak-admin-secret in the rossoctl-system namespace ("Operator 0.2+ keeps it
in rossoctl-system for client registration"). On the current operator (v0.7.0)
this secret does not exist in a Helm-based install and is not used, so the
instruction sends users chasing a NotFound that is actually expected.

What actually happens on v0.7.0

• The operator registers Keycloak clients using its own SPIFFE workload identity,
  federated into Keycloak by the rossoctl-operator-client-bootstrap post-install job
  (runs in the keycloak namespace). It does not read an admin username/password Secret
  at runtime.

• The admin credentials the bootstrap job needs come from keycloak-initial-admin
  in the keycloak namespace (Helm default keycloak.adminSecretName=keycloak-initial-admin),
  not a keycloak-admin-secret in rossoctl-system.

• Confirmed on a fresh quickstart cluster: keycloak-admin-secret is absent in both
  team1 and rossoctl-system, the controller-manager has no admin env vars and cannot
  read the admin secret, yet client registration succeeds:

  "operator client registration applied" ... workload=weather-tool namespace=team1
  secret=rossoctl-keycloak-client-credentials-<hash>
  

The keycloak-admin-secret-in-rossoctl-system handling only survives in CI helper
scripts (.github/scripts/operator/41-wait-crds.sh etc. in the rossoctl repo) as a
compatibility shim; the Helm/quickstart path neither creates nor needs it.

Affected sections

1. Installer-Provided Resources (the "keycloak-admin-secret is not in team1 …
   keeps it in rossoctl-system" note + kubectl get secret keycloak-admin-secret -n rossoctl-system).
2. Troubleshooting → Invalid Client or Invalid Client Credentials (cause text and
   step 1 both reference keycloak-admin-secret).

The "Check operator-managed client registration" section is already correct and needs
no change.

Proposed fix

Drop the keycloak-admin-secret / rossoctl-system instructions and point users at the
per-workload rossoctl-keycloak-client-credentials-* Secret and the operator
"client registration applied" log line instead. PR to follow.