Remove MilpacService.GetUserViaKeycloakId (Phase 2 of 2)

[SyniRon]

This was generated by AI during triage.

Phase 2 of the GetUserViaKeycloakId decom — removal

This is the removal half of the 2-phase keycloak-lookup decom. Blocked by #97 (Phase 1, deprecation).

Scope

After unblockers land:

• Delete MilpacService.GetUserViaKeycloakId from proto/milpacs.proto.
• Delete the keycloak_id field from Profile, the equivalent field on LiteProfileResponse, and any other profile message that carries it. Remove KeycloakIdRequest itself once no longer referenced.
• Regenerate. buf breaking will flag the RPC and field removals — intentional, accept the break.
• Delete FindProfileByKeycloakID from the Datastore interface and from the Mysql implementation.
• Delete the handler in the gRPC service.
• Delete extractKeycloakID and any Provider == "keycloak" branches in datastores/mysql.go if they have no remaining call sites.
• Delete the associated tests in servers/grpc/milpacs_test.go (TestGetUserViaKeycloakId_NotFound, TestGetUserViaKeycloakId_DatastoreError). Easy to miss — the handler being gone won't auto-delete the tests; they'll fail to compile.
• Regenerated *.pb.go / *.pb.gw.go / openapi/assets/*.swagger.json reflect the removal and are committed.
• CLAUDE.md's soft-deprecation note about GetUserViaKeycloakId is removed (or updated to past tense).

Unblockers

1. Deprecate MilpacService.GetUserViaKeycloakId in proto (Phase 1 of 2) #97 (Phase 1) must ship in a release. Deprecation has to be visible in the OpenAPI spec to any remaining consumer before removal.
2. One release cycle must elapse post-Phase 1 so consumers had a real window to react.
3. Add request analytics — endpoint volume, latency, error rates, top consumers #92 (analytics) must confirm zero traffic on /api/v1/milpac/keycloak/{keycloak_id} over an agreed window (parent ticket suggested ~1 week). Without traffic data, removal is on a hunch — not the bar this codebase holds.

Coordination caveat

If #95 (drop gRPC entirely) goes forward before the unblockers above are satisfied, this work collapses into that rewrite — the keycloak field/RPC simply doesn't get re-emitted in the huma version. Close as superseded if that happens.

Related

• Deprecate MilpacService.GetUserViaKeycloakId in proto (Phase 1 of 2) #97 — Phase 1 (deprecation), this ticket's blocker.
• Add request analytics — endpoint volume, latency, error rates, top consumers #92 — analytics; gates unblocker New Endpoints #3.
• Spitball: drop gRPC, rewrite as plain net/http + huma JSON service #95 — drop-gRPC investigation; would supersede this work if it lands first.