chore: drop unimplemented BFF session config (out of scope)

[polaz]

BffConfig is parsed but never implemented, and on reflection it does not belong in this crate: BFF is stateful session / token-lifecycle management (a separate product, e.g. oauth2-proxy / Pomerium), whereas this proxy is a stateless transcoding data plane with stateless auth primitives (JWT, forward-auth, ext_authz, OIDC discovery). A server-side session/token store would also break the multi-instance-stateless design.

Changes

• Remove BffConfig, the auth.bff field, and its defaults.
• Reword the OpenAPI cookie security-scheme description so it no longer references a BFF login flow.
• README: drop BFF from the Roadmap; add a Non-goals note (use a dedicated BFF in front, or the forward-auth / authz hooks).

No behavior change (the field was never wired). Estimate: 1h

[coderabbitai]

🔗 Related PRs

#20 - chore: crates.io badges, README accuracy, release-plz migration [merged]
#28 - feat(auth): enforce JWT validation with JWKS and route policies [merged]
#30 - feat(oidc): serve OpenID discovery document and JWKS endpoint [merged]
#34 - feat(auth): forward-auth verification endpoint [closed]
#36 - feat(authz): external authorization via Envoy ext_authz gRPC [closed]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!