fix(controlplane): remove the RobotAccountService/Create RPC (CP-N4)

Robot accounts are superseded by workflow-scoped API tokens, which offer the
same per-workflow granularity plus a finite expiration, revocation coverage and
an explicit policy set. Creation was removed from the CLI in 2024 (#890, #894)
and has had no caller in any Chainloop component since: no reference in the CLI,
the frontend or the platform backend, only generated stubs.

Removing the RPC removes the escalation at the root rather than restricting who
may reach it. Deleted: the proto method and its request/response messages, the
service handler, RobotAccountUseCase.Create, RobotAccountRepo.Create, and the
now-orphaned authConf field on the use case (regenerated wire accordingly). The
RobotAccount.JWT field went with it, since only the deleted creation path ever
set it.

List and Revoke are deliberately kept. Existing robot accounts never expire and
still authenticate for attestation through RobotAccountUseCase.FindByID, so
inventory and revocation must stay available to retire them; removing Revoke
would strand permanent credentials with no kill switch.

The robot-account integration test now seeds through the ent client, since
creation is no longer reachable from the use case, and continues to cover
revocation.

This is a wire-breaking change: a pre-2024 client still calling
RobotAccountService/Create receives Unimplemented instead of a credential.

Assisted-by: Claude Code
Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>

Author: migmartri

app/controlplane/api/controlplane/v1/robot_accounts.pb.go

@@ -22,31 +22,14 @@ import "google/protobuf/timestamp.proto";
 
 option go_package = "github.com/chainloop-dev/chainloop/app/controlplane/api/controlplane/v1;v1";
 
+// Deprecated: superseded by workflow-scoped API tokens. Create was removed because its policy was
+// grantable to API tokens (privilege escalation); List and Revoke remain so that existing robot
+// accounts, which never expire, can still be inventoried and retired.
 service RobotAccountService {
-  rpc Create(RobotAccountServiceCreateRequest) returns (RobotAccountServiceCreateResponse);
   rpc List(RobotAccountServiceListRequest) returns (RobotAccountServiceListResponse);
   rpc Revoke(RobotAccountServiceRevokeRequest) returns (RobotAccountServiceRevokeResponse);
 }
 
-message RobotAccountServiceCreateRequest {
-  string name = 1;
-  string workflow_id = 2 [(buf.validate.field).string.uuid = true];
-}
-
-message RobotAccountServiceCreateResponse {
-  RobotAccountFull result = 1;
-
-  message RobotAccountFull {
-    string id = 1;
-    string name = 2;
-    string workflow_id = 3;
-    google.protobuf.Timestamp created_at = 4;
-    google.protobuf.Timestamp revoked_at = 5;
-    // The key is returned only during creation
-    string key = 6;
-  }
-}
-
 message RobotAccountServiceRevokeRequest {
   string id = 1 [(buf.validate.field).string.uuid = true];
 }