fix(gateway): point admin auto-approve warnings at identityScopes (#129538)

The startup SECURITY WARNING and the critical security-audit remediation for
gateway.auth.trustedProxy.deviceAutoApprove.scopes containing operator.admin
still told operators to wait "until per-identity roles are available".
Per-identity admin grants shipped as gateway.auth.identityScopes and the
trusted-proxy docs already recommend them; the runtime guidance now names
that shipped fix instead of a nonexistent future feature.

src/gateway/server-startup-bootstrap.ts

@@ -271,7 +271,7 @@ export async function prepareGatewayServerBootstrap(input: {
     trustedProxyDeviceAutoApprove.scopes?.some((scope) => scope.trim() === ADMIN_SCOPE)
   ) {
     log.warn(
-      "SECURITY WARNING: gateway.auth.trustedProxy.deviceAutoApprove.scopes includes operator.admin; every proxy-authenticated user can auto-approve a new browser device with full admin, and requests without scopes receive full admin automatically. Remove operator.admin to require manual approval until per-identity roles are available.",
+      "SECURITY WARNING: gateway.auth.trustedProxy.deviceAutoApprove.scopes includes operator.admin; every proxy-authenticated user can auto-approve a new browser device with full admin, and requests without scopes receive full admin automatically. Remove operator.admin and grant admin per identity via gateway.auth.identityScopes instead.",
     );
   }
   const resolvedStartupAuthOverride = startupAuthOverride

src/gateway/server.auth.trusted-proxy-device-autoapprove.test.ts

@@ -212,7 +212,7 @@ describe("trusted-proxy browser device auto-approval", () => {
     expect(
       warnings.filter((message) =>
         message.includes(
-          "SECURITY WARNING: gateway.auth.trustedProxy.deviceAutoApprove.scopes includes operator.admin; every proxy-authenticated user can auto-approve a new browser device with full admin, and requests without scopes receive full admin automatically. Remove operator.admin to require manual approval until per-identity roles are available.",
+          "SECURITY WARNING: gateway.auth.trustedProxy.deviceAutoApprove.scopes includes operator.admin; every proxy-authenticated user can auto-approve a new browser device with full admin, and requests without scopes receive full admin automatically. Remove operator.admin and grant admin per identity via gateway.auth.identityScopes instead.",
         ),
       ),
     ).toHaveLength(1);

src/security/audit-gateway-config.ts

@@ -373,7 +373,7 @@ export function collectGatewayConfigFindings(
           detail:
             "gateway.auth.trustedProxy.deviceAutoApprove.scopes includes operator.admin, so every proxy-authenticated user can auto-approve a new browser device with full admin; requests without scopes receive full admin automatically.",
           remediation:
-            "Remove operator.admin and approve admin access manually, or use per-identity roles when they become available.",
+            "Remove operator.admin and approve admin access manually, or grant admin per identity via gateway.auth.identityScopes.",
         });
       }
     }

src/security/audit-gateway-exposure.test.ts

@@ -504,7 +504,7 @@ describe("security audit gateway exposure findings", () => {
       detail:
         "gateway.auth.trustedProxy.deviceAutoApprove.scopes includes operator.admin, so every proxy-authenticated user can auto-approve a new browser device with full admin; requests without scopes receive full admin automatically.",
       remediation:
-        "Remove operator.admin and approve admin access manually, or use per-identity roles when they become available.",
+        "Remove operator.admin and approve admin access manually, or grant admin per identity via gateway.auth.identityScopes.",
     });
   });