refactor(azure): remove unused config fields and Traefik Forward Auth

[Lytol]

Description

This PR removes unused configuration fields from AzureWorkloadConfig and removes the incomplete/broken Traefik Forward Auth feature for Azure workloads.

Changes

Removed 6 Unused Config Fields

The following fields were defined but never used in the codebase:

• client_id / ClientID - Never referenced; managed identities are created dynamically
• secrets_provider_client_id / SecretsProviderClientID - Only used by Traefik Forward Auth (also removed)
• instance_type / InstanceType - Replaced by node pool instance type configs
• control_plane_node_count / ControlPlaneNodeCount - Not applicable to managed AKS
• worker_node_count / WorkerNodeCount - Replaced by node pool configs
• db_storage_size_gb / DBStorageSizeGB - Value hardcoded to 128 in implementation

Removed Traefik Forward Auth for Azure Workloads

The Traefik Forward Auth feature for Azure was incomplete and broken:

• Required manual managed identity setup (never documented)
• Used legacy VM-based identity instead of modern workload identity
• Hardcoded to Okta only
• Inconsistent with how other services manage identities

Note: AWS Traefik Forward Auth support remains intact and functional.

Files Changed

• lib/types/workload.go - Removed 6 fields from AzureWorkloadConfig
• lib/types/workload_test.go - Updated tests
• python-pulumi/src/ptd/azure_workload.py - Removed 6 fields
• python-pulumi/src/ptd/pulumi_resources/azure_workload_clusters.py - Removed Traefik Forward Auth integration
• python-pulumi/src/ptd/pulumi_resources/traefik_forward_auth_azure.py - Deleted (117 lines)
• python-pulumi/tests/test_azure_bastion_config.py - Updated tests

Category of change

• Refactor: a code change that neither fixes a bug nor adds a feature

Testing

• ✅ All Python tests pass (111 passed)
• ✅ All Go tests pass
• ✅ Build successful
• ✅ just runs cleanly
• ⏳ Still need to verify against internal workload