chore: cleanup go-api azure-pipline

[thenav56]

go-api now deploys via ArgoCD (ns go-api). This removes the legacy pipeline, Helm release and Terraform leftovers.

Checklist

• ADO pipeline IFRCGO - backend disable - https://dev.azure.com/IFRC/IFRC_GO/_build?definitionId=240

Staging (merge to develop)

• Apply result: helm_release.ifrcgo dropped from state (not uninstalled); ifrctgo-disk001, its Contributor role assignment and the ifrcgo-terraform-managed-resources ConfigMap destroyed.
• Uninstall the legacy release. Removes StatefulSet ifrcgo-helm-ssh-bastion, Service ssh-bastion, 3 ConfigMaps, Secret ifrcgo-helm-api-secret. Nothing in ns go-api.

  az aks get-credentials --resource-group ifrctgo002rg --name ifrctgo-cluster
  helm -n default get manifest ifrcgo-helm | grep -E '^kind:|^  name:'   # review first
  helm -n default uninstall ifrcgo-helm

  
• List federated credentials. Keep system:serviceaccount:go-api:service-token-reader (Terraform-managed, named go-api-staging-secret-reader-identity).

  az identity federated-credential list \
    --identity-name GoApiStagingWorkloadIdentity \
    --resource-group ifrctgo002rg \
    --query "[].{name:name, subject:subject}" -o table

  
• If one has a system:serviceaccount:default:... subject, delete it. It is unmanaged and was created outside Terraform, so its name is not predictable: take it from the listing above.

  az identity federated-credential delete \
    --identity-name GoApiStagingWorkloadIdentity \
    --resource-group ifrctgo002rg \
    --name workload-federation

  
• Delete the leftover service account if still there.

  kubectl -n default delete serviceaccount go-api-staging-workload-sa --ignore-not-found

  
• Verify goadmin-stage.ifrc.org still serves, then soak before production.

Production (merge to master)

• Apply result: same as staging, with ifrcpgo-disk001.
• Uninstall the legacy release.

  az aks get-credentials --resource-group ifrcpgo002rg --name ifrcpgo-cluster
  helm -n default get manifest ifrcgo-helm | grep -E '^kind:|^  name:'   # review first
  helm -n default uninstall ifrcgo-helm

  
• List federated credentials. Keep go-api-production-secret-reader-identity.

  az identity federated-credential list \
    --identity-name GoApiProductionWorkloadIdentity \
    --resource-group ifrcpgo002rg \
    --query "[].{name:name, subject:subject}" -o table

  
• Delete any with a system:serviceaccount:default:... subject.

  az identity federated-credential delete \
    --identity-name GoApiProductionWorkloadIdentity \
    --resource-group ifrcpgo002rg \
    --name workload-federation

  
• Delete the leftover service account if still there.

  kubectl -n default delete serviceaccount go-api-production-workload-sa --ignore-not-found

  
• Verify goadmin.ifrc.org still serves.

Follow-up PR (after both environments) #240

• Delete resources/helm-ifrcgo.tf (the removed block).
• Delete provider "kubernetes" in resources/aks.tf and the kubernetes entry in resources/providers.tf. Cannot be done earlier: Terraform needs the provider present to destroy the ConfigMap.
• Clear terraform/imports.tf.
• Remove the stale go-api TODO in resources/bastion.tf:8-11 and the values-file reference at :51.
• README.md:14: drop the applications/go-api entry.
• Delete ADO pipeline definition 240 and its STAGING_* / PRODUCTION_* secret variables. Leave the IFRCGo service connection, which base-infrastructure/azure-pipelines.yml uses.