API-key auth decoupled from Keycloak — IdP session revocation is no longer a kill switch for machine keys

What this changes for operators

• PR #14867 (merged to main 2026-06-17, NOT in any tag) decouples API-key (Bearer) auth from Keycloak offline sessions: API-key authentication performs zero Keycloak round-trips, so a revoked or expired IdP session no longer invalidates a machine key. Headless clients stop hitting opaque 401s — but the revocation contract changed.
• Operators who relied on Keycloak session revocation to kill machine keys must now revoke at the key store instead. This is on main, in no release.