Remove config.groupRef fallback and external_auth_config_ref enum

[ChrisJBurns]

Summary

Remove deprecated backwards-compatibility code from VirtualMCPServer: the config.groupRef fallback in ResolveGroupName()/Validate() and the external_auth_config_ref snake_case enum value from BackendAuthConfig.Type. Also promotes spec.groupRef from +optional to +kubebuilder:validation:Required.

Closes #4831

Medium level

• ResolveGroupName() simplified to only return spec.groupRef.name (no fallback to Config.Group)
• Validate() now requires spec.groupRef.name instead of accepting either field
• GroupRef promoted from +optional to +kubebuilder:validation:Required — the API server now rejects resources missing groupRef at admission time
• Converter explicitly sets config.Group = vmcp.ResolveGroupName() after DeepCopy so downstream runtime code still works
• DeprecatedBackendAuthTypeExternalAuthConfigRef constant removed along with its deprecation warning, kubebuilder enum entry, and switch case handling
• All test fixtures updated to use GroupRef; redundant Config.Group removed from fixtures

Low level

File	Change
cmd/thv-operator/api/v1alpha1/virtualmcpserver_types.go	Simplify ResolveGroupName(), tighten Validate(), make GroupRef required, remove deprecated constant and enum value, clean up comments
cmd/thv-operator/pkg/vmcpconfig/converter.go	Add config.Group = vmcp.ResolveGroupName() after DeepCopy; remove deprecated snake_case handling
pkg/vmcp/config/config.go	Update Config.Group comment to reflect current usage (no longer deprecated)
docs/operator/virtualmcpserver-api.md	Remove deprecation notes, update examples to use camelCase externalAuthConfigRef
*_test.go (14 files)	Add GroupRef to all VirtualMCPServer test fixtures, remove redundant Config.Group, add Validate_RequiresGroupRef test
CRD manifests + crd-api.md	Regenerated

Migration guide

This is a breaking change for users of the deprecated fields:

spec.config.groupRef → spec.groupRef

Before:

spec:
  config:
    groupRef: "my-group"

After:

spec:
  groupRef:
    name: "my-group"

spec.groupRef is now required — the API server will reject VirtualMCPServer resources that omit it. The old spec.config.groupRef string is no longer read by the operator.

external_auth_config_ref → externalAuthConfigRef

Before:

spec:
  outgoingAuth:
    backends:
      my-backend:
        type: external_auth_config_ref

After:

spec:
  outgoingAuth:
    backends:
      my-backend:
        type: externalAuthConfigRef

The snake_case value is no longer accepted by the CRD schema.

Type of change

• Breaking change

Test plan

• task lint-fix passes
• task test passes (operator unit tests)
• go build ./cmd/... passes
• CRD manifests and API docs regenerated
• New unit test TestVirtualMCPServer_Validate_RequiresGroupRef covers nil and empty-name rejection paths

Special notes for reviewers

• Config.Group in pkg/vmcp/config/config.go is deliberately kept — it is still used by the standalone CLI path. The operator converter populates it from spec.groupRef during conversion.
• GroupRef is now +kubebuilder:validation:Required (without omitempty), matching the IncomingAuth pattern on the same struct. The Validate() check remains as defense-in-depth for the groupRef: {} edge case.

Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.15%. Comparing base (60108a1) to head (230db24).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4834      +/-   ##
==========================================
+ Coverage   69.14%   69.15%   +0.01%     
==========================================
  Files         530      530              
  Lines       55278    55270       -8     
==========================================
+ Hits        38220    38223       +3     
+ Misses      14132    14120      -12     
- Partials     2926     2927       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[ChrisJBurns]

Multi-Agent Consensus Review

Agents consulted: kubernetes-expert, code-reviewer, toolhive-expert

Consensus Summary

#	Finding	Consensus	Severity	Action
1	crd-api.md needs rebase (telemetry note conflict)	10/10	MEDIUM	Rebase
2	Missing Validate() test for Config.Group-only rejection	8/10	MEDIUM	Discuss
3	No migration/upgrade documentation for breaking change	7/10	MEDIUM	Discuss
4	Stale test fixtures (DefaultValues, NamespaceIsolation)	10/10	LOW	Discuss
5	Redundant Config.Group in controller test fixtures	10/10	LOW	Info
6	GroupRef +optional despite being required at runtime	9/10	INFO	Info

Overall

Clean deprecation removal that correctly eliminates all three aspects of the backwards-compatibility code: the Go constant, the kubebuilder enum value, and the fallback logic. The converter bridge (config.Group = vmcp.ResolveGroupName()) is well-placed and follows the established pattern of overriding authoritative fields after DeepCopy.

The main concern is that the PR branch appears to predate the telemetry deprecation note addition to crd-api.md on main, which will likely cause a merge conflict on the config field description line. The fix is straightforward — rebase and regenerate. The two MEDIUM test/docs findings are worth discussing but not blocking: adding a Validate() test for the specific breaking-change path would strengthen coverage, and migration guidance would help users upgrading from the deprecated patterns.

Additional Findings (not in diff)

• [LOW] Stale test fixtures (F4): TestVirtualMCPServerDefaultValues (~line 140) and TestVirtualMCPServerNamespaceIsolation (~line 167) in virtualmcpserver_types_test.go still construct fixtures using only Config.Group without GroupRef. These tests don't call Validate() so they pass, but they represent stale patterns inconsistent with the rest of the PR. Adding GroupRef to these two tests would be a minimal fix.

---

Generated with Claude Code