Revert "feat(dgw): route KDC traffic through agent tunnel" (#1781)

[irvingouj@Devolutions (irvingoujAtDevolution)]

Reverts #1781, plus re-applies the listener.rs Arc::clone master-compile fix.

⚠️ Please merge as "Create a merge commit" or "Rebase and merge" — not squash. The two commits must stay separate in history.

Do not enable auto-merge.

What happened (timeline)

1. feat(dgw): route KDC traffic through agent tunnel #1781 was rebased + extended by Claude Code (acting on my behalf). During the rebase, Claude applied review feedback — including a jti-as-session-id suggestion from Benoît Cortier (@CBenoit). The implementation of that suggestion reshaped the public KdcToken extractor from a tuple struct to a named-fields struct:

   -pub struct KdcToken(pub KdcTokenClaims);
   +pub struct KdcToken {
   +    pub claims: KdcTokenClaims,
   +    pub jti: uuid::Uuid,
   +}

   This is a public API surface change that should have been called out separately. It was not.

2. Claude also enabled auto-merge while the PR was still being iterated. Benoît Cortier (@CBenoit) had already LGTM'd an earlier clean version. Auto-merge took my final force-push to master before I had a chance to final-diff.

3. Result: master got a public API reshape I did not intend, on top of the functionally-correct DGW-384 work.

This is my process gap — I authorized an automated rebase, then didn't gate the merge behind a final review. Reverting now, then re-doing DGW-384 the right way, is cheaper than carrying the API shape forward.

Commits in this PR

1. c3f20661 — Revert "feat(dgw): route KDC traffic through agent tunnel". Byte-for-byte undo of feat(dgw): route KDC traffic through agent tunnel #1781's squash commit; tree matches 6f692e75 (pre-feat(dgw): route KDC traffic through agent tunnel #1781 master) exactly.

2. 042cd88f — fix: clone ca_manager Arc to unbreak master build. The listener.rs Arc::clone fix originally proposed in fix(agent-tunnel): clone ca_manager Arc to unbreak master build #1790 (closed). feat(dgw): route KDC traffic through agent tunnel #1781 incidentally carried this fix; the revert removes it; master would not compile without it. Reapplied here in its own commit so future archeology shows the master-compile fix is independent of DGW-384.

Follow-up plan (separate PRs)

• DGW-384 redo: new PR that surfaces the KDC token's jti by adding it to KdcTokenClaims itself (and its KdcClaimsHelper serde plumbing), so KdcToken keeps its original tuple-struct shape. The other DGW-384 work (CredSSP / HTTP agent-tunnel routing, explicit_agent_id, hardening) will come back in that PR, unchanged on the wire.
• No follow-up needed for the listener.rs fix — it lands in this PR.

Issue: DGW-384

[github-actions]

Let maintainers know that an action is required on their side

• Add the label release-required Please cut a new release (Devolutions Gateway, Devolutions Agent, Jetsocat, PowerShell module) when you request a maintainer to cut a new release (Devolutions Gateway, Devolutions Agent, Jetsocat, PowerShell module)

• Add the label release-blocker Follow-up is required before cutting a new release if a follow-up is required before cutting a new release

• Add the label publish-required Please publish libraries (`Devolutions.Gateway.Utils`, OpenAPI clients, etc) when you request a maintainer to publish libraries (Devolutions.Gateway.Utils, OpenAPI clients, etc.)

• Add the label publish-blocker Follow-up is required before publishing libraries if a follow-up is required before publishing libraries