docs: apply the operator's rulings on Kasm, revocation and fault injection

Retire Kasm from the catalog. Drop ACME revocation from R-TLS-02. Make L3
fault injection operator-run and exclude it from the merge gate (R-TEST-03,
ADR-0026). Update the gap register to match; Homepage authentication is now
ruled must-enforce and stays a gap until the implementation lands.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/15-identity-and-access.md

@@ -21,7 +21,7 @@ Every service authenticates against Keycloak, via whichever pattern it supports:
 
 1. **Native OIDC** — the app is configured as a Keycloak OIDC **client** and does its own login
    redirect. Preferred where available. Initial set: **Gitea, Nextcloud, Grafana, Semaphore,
-   Headlamp** (Kasm, not onboarded, joins this set when it is).
+   Headlamp**.
 2. **Forward-auth gate** — for apps with **no** usable OIDC, a per-app identity-aware proxy
    (**oauth2-proxy**) runs as a sidecar in the app's pod, authenticates the user against Keycloak,
    and only then forwards the request ([ADR-0022](../decisions/adr-0022-forward-auth-per-app-oauth2-proxy-sidecars.md)).