chore: drop authEnabled config and document SPA mock-mode

[vredchenko]

Summary

Pairs with smartem-frontend#101, which dropped the VITE_AUTH_ENABLED env var and the authEnabled field from runtime /config.json. Auth is now always on at the SPA level; the backend likewise enforces Bearer-token validation unconditionally (smartem-decisions#285).

Changes

• k8s ConfigMaps (k8s/environments/{development,staging,production}/smartem-frontend.yaml): drop the authEnabled field from the mounted config.json. Dev manifest's explanatory comment updated to reflect the toggle no longer exists.
• docs/development/local-keycloak.md: replaces the "Disabling auth entirely" section with a "Mock mode" section describing npm run dev:smartem:mock and the MockAuthProvider path. Clarifies that mock mode is distinct from the "Keycloak unreachable" error state.
• keycloak-mock/README.md: drops authEnabled from the config.json example.
• docs/architecture/keycloak-spa-authentication.md: adds a Mock-mode subsection under "Local development" describing the MockAuthProvider swap and MSW interception. Also fixes a stale SmartEM client reference to SmartEM_User (the rename in smartem-frontend 0b37453).

Notes

• The webui MDX mirrors of these docs are generated by webui/scripts/prebuild.ts from the docs/ sources and gitignored (webui/.gitignore line 32), so no MDX changes are committed; they regenerate on next npm run prebuild/dev/build.
• No code or behaviour change in this repo — k8s ConfigMaps still mount the same config.json path, just without the dead field.

Test plan

• All three modified k8s manifests still parse as valid YAML (python3 -c "yaml.safe_load_all(...)" clean).
• No remaining authEnabled/VITE_AUTH_ENABLED references in the repo (only the new explanatory comment in the dev manifest references the historical name).
• Reviewer: regenerate MDX mirrors (cd webui && npm run prebuild) and confirm the architecture-doc and local-keycloak pages render the new Mock-mode copy in the webui dashboard.
• After merge: redeploy SPA to dev cluster and confirm the SPA still boots cleanly with the trimmed config.json (Keycloak URL still loaded, no authEnabled reference path in the SPA code anyway as of smartem-frontend#101).