Retire the adminConsole workload; the server serves every console under /console (authup 1.0.0-beta.64+)

[tada5hi]

What changed upstream

Since authup/authup#3501 (unreleased as of 1.0.0-beta.63, lands in the next release) the admin console is a static SPA served by server-core, and the image's client/admin-console start service prints a notice and exits 1. A chart with adminConsole.enabled: true (the default, values.yaml:843) therefore crash-loops that Deployment against the next appVersion.

Two follow-ups change the URL surface and the topology once more, so the chart should absorb all three in one major:

• feat(server-core,client-web-kit)!: mount the consoles under /console/{admin,account,auth} authup#3503: every served console moves under one prefix: /console/admin (admin console), /console/account (account console), /console/auth/assets/ (the auth console's assets). The auth PAGES stay at the root (/authorize, /logout, /register, /activate, /password-forgot, /password-reset). No redirect from /admin or /account.
• feat(server-core): console role authup#3504: a third long-running role, server/core console [admin|account], the IdP surface without the management API, serving the consoles. Optional; start still serves everything.
• feat(authup)!: retire the launcher; the smoke runner moves to server-core authup#3505: the authup launcher package is gone (not on the image's path; no chart impact beyond docs that mention authup start).

Chart changes

1. Remove the adminConsole.* workload (Deployment, Service, Ingress/Route rules, the NUXT_PUBLIC_* / API_URL env wiring, the values.schema.json block, the TRUSTED_ORIGINS auto-append of the console origin at values.yaml:419, which is no longer needed: the served console shares publicUrl's origin). Ship as a chart major and name the crash-loop in the release notes.
2. Route everything to server-core. With a single Deployment nothing else is needed: server.ingress.path: / already covers /console/**. Document ADMIN_CONSOLE_ENABLED / ACCOUNT_CONSOLE_ENABLED next to the existing accountConsole value (values.yaml:432, its comment says /account; it is /console/account now).
3. PUBLIC_URL must name the ingress host (both consoles derive their API address from it and cookie mode only works same-origin); check the derivation at values.yaml:409 still yields the host the browser sees.
4. Optional: a console replica set. A second Deployment running server/core console with the ingress routing /console/** (and /theme/** when themed) to it and everything else to the API set. Constraints from the upstream docs (docs/src/guide/deployment/console-replicas.md): Redis is REQUIRED for the split (the authorization code is a cache entry minted on the API set and redeemed on the console replica), both sets need COMPONENTS_ENABLED=false and MIGRATION_ENABLED=false with the migration Job doing the DDL (the shape the chart already has for the worker), sqlite cannot split. Fine to leave this for a later minor; the value shape would mirror the worker's.
5. Docs/README mentions of /admin, /account, authup start.

References

• authup/authup plan 098 A1 (the item this issue tracks) and plan 099 (the mounts, the role, the launcher).
• Upgrade notes: docs/src/guide/deployment/upgrading.md in feat(server-core,client-web-kit)!: mount the consoles under /console/{admin,account,auth} authup#3503 and #3505.