[slayerjain]

What

The Kubernetes Proxy REST API page told every caller, CI pipelines included, to exchange a personal access token for the cluster's shared token (POST /get-shared-token, or the Console's Get Agent Token button) and to send that token on every call.

That token is the credential the proxy's own in-cluster components (the node agents and the replay runner) authenticate with. It names no user, so a copy held by a CI system carries cluster-wide authority with no owner and no per-consumer revocation. keploy/k8s-proxy#1126 makes the proxy accept the shared token only on the routes those components call, in every RBAC mode, and answer 403 everywhere else. That is a hard cut: there is no grace period and no release that only logs, so a script still sending the shared token gets the 403 from the upgrade on.

This PR moves the docs to what replaces it, which the proxy already accepts today.

• Authentication sends a key straight in Authorization: Bearer <key>: a service-account key for CI and automation, or a PAT for a person. The section covers:
  • what a key can call (per-route permissions; enforce against the default audit mode);
  • setting up a service account for CI: a key bound to ITG_RUNNER for keploy cloud replay, or ATG_RUNNER for keploy test-suite --cloud, with key expiry and rotation;
  • the failure modes, and how long the proxy caches a validation.
• Neither CI command starts or stops a recording or a replay through the proxy. Starting or stopping a recording or an in-cluster replay over the API (/record/start, /record/stop, /test/start, /test/stop) is a person's action, done with their own PAT. Under enforce that person needs the record or replay permissions on the cluster.
• The PAT-to-shared-token exchange is documented as deprecated. The page shows the 403 the shared token now gets, with its MACHINE_CREDENTIAL_REFUSED code and its message, and explains how to migrate a script: send the key itself, and drop the exchange and any tokenId caching.
• The quick start, the endpoint reference and the static-deduplication example use the key directly.
• The endpoint reference says what POST /agent/execute-request reaches. It needs testgen:run and refuses the shared token. It sends a request only to an app Service the proxy manages, by its full in-cluster name, on one of the Service's ports, with TLS verified and redirects not followed. Any other target is a 403 that says why.
• The failure table adds the multi-replica 503: a replica that cannot verify which replica owns a recording or replay forwards nothing. It answers OWNER_REPLICA_UNVERIFIED with a Retry-After header, and the fix is to let the proxy's service account get and list pods.
• The Console menu paths are current: keys under Account › API Keys (the Generate new token button), service accounts under Account › Service Accounts, and the Get Agent Token button by its label. This covers the REST API page, smart-set-agent.md, k8s-proxy-llm-workflow.md and cloud-replay.md.

Ordering

Sending a PAT or a service-account key directly already works on current proxy releases, so the new instructions are safe to publish before the proxy change. The statements that the shared token gets 403 become true with the k8s-proxy release that carries keploy/k8s-proxy#1126. This PR should merge with that change or before it.