docs: Document outbound passthrough policy and route-based token exchange

[mrsabath]

Summary

• Updated CLAUDE.md and AuthBridge/CLAUDE.md to reflect the passthrough-by-default outbound model introduced in fix: Correct authproxy-routes host pattern and add Keycloak scope ass… #188
• Documented the authproxy-routes ConfigMap format for per-host token exchange rules
• Separated keycloak-admin-secret Secret from the environments ConfigMap in the runtime resource tables
• Added DEFAULT_OUTBOUND_POLICY and ROUTES_CONFIG_PATH environment variable documentation
• Added three new gotchas covering: route host pattern matching with HTTP Host headers, Keycloak scope assignment for dynamically registered clients, and outbound passthrough as the safe default

Relates to #185

Test plan

• Verify CLAUDE.md renders correctly on GitHub
• Verify AuthBridge/CLAUDE.md renders correctly on GitHub
• Confirm documented ConfigMap format matches actual authproxy-routes usage in demos

[pdettori]

Review Summary

Clean docs update capturing operational knowledge from the passthrough-by-default outbound model (#188). Well-structured route resolver docs and valuable new gotchas.

Areas reviewed: Docs/Markdown (2 files, ~47 additions/~41 deletions)
Commits: 1 commit, signed-off with correct Assisted-By attribution
CI: CI Checks pass, DCO pass

Highlights

• Route resolver section clearly explains host matching semantics and filepath.Match behavior
• Gotchas #7-8 (passthrough default, short service names) will save debugging time
• Separating keycloak-admin-secret from environments in the resource table is a good accuracy improvement

Items to verify (non-blocking)

1. routes.yaml format — The example now shows a routes: top-level key wrapping the list. The old format was a bare YAML list. Verify this matches the actual go-processor parsing — if the code expects a bare list, this example would be misleading.
2. Default path — Changed from /etc/authproxy/routes.yaml to /etc/authproxy-routes/routes.yaml. Confirm this matches the actual ConfigMap mount path.
3. SPIRE_ENABLED key — The environments ConfigMap lost SPIRE_ENABLED from its key fields in the table. If still a valid key, consider keeping it.