refactor: migrate users, ACLs, quotas from REST to Connect RPC

[c-julin]

Summary

Phase 1 of the REST-to-Connect RPC migration (UX-1199, epic UX-1198).

The frontend already uses Connect Query hooks for users, ACLs, and quotas — calling dataplane.v1.UserService, ACLService, and QuotaService directly. The REST handlers and their backend-api.ts REST calls were dead code still being served but no longer consumed. This PR removes them along with the now-orphaned ConsoleSvc methods.

RFC: https://docs.google.com/document/d/1RUUzvXmjC4c4Fa4DEUmrOLm_xXAIvsIWsf5f1k12epg/edit

Enterprise counterpart: redpanda-data/console-enterprise#759

Cross-repo coordination (UX-1213)

The cross-repo audit identified apps/redpanda-connect-api/tenant/api.go in cloudv2 as a consumer that called POST /api/users, GET /api/users, and POST /api/acls directly on Console. That consumer has now been migrated to the Connect RPC equivalents, so this PR no longer breaks Redpanda Connect pipeline provisioning.

tests/e2e-billing/pkg/consoleapi/consoleapi.go (test-only, lower impact) is the only remaining REST caller. Phase 2 will affect this consumer further (POST/GET /api/topics); Phases 3 and 4 are clean.

Changes

Users (handle_users.go — deleted, 207 lines)

• Removed REST handlers for GET/POST/DELETE /api/users
• Removed refreshServiceAccounts, createServiceAccount, deleteServiceAccount from backend-api.ts
• Removed GetUsersResponse, CreateUserRequest types from rest-interfaces.ts
• Frontend already uses Connect RPC dataplane.v1.UserService via react-query/api/user.tsx

ACLs (handle_acls.go — create/delete removed, 152 lines)

• Removed handleCreateACL and handleDeleteACLs REST handlers
• Removed POST/DELETE /api/acls route registrations
• Removed createACL, deleteACLs from backend-api.ts
• Removed legacy ACL conversion functions from react-query/api/acl.tsx
• Kept GET /api/acls — still needed for isAuthorizerEnabled detection in Zustand store (tracked for Phase 2 cleanup)

Quotas (handle_quotas.go — deleted, 24 lines)

• Removed REST handler for GET /api/quotas
• Removed refreshQuotas and Quotas state from backend-api.ts
• Removed QuotaResponse* types from rest-interfaces.ts

Dead code cleanup

• Removed CreateACL, DeleteACLs, DescribeQuotas from Servicer interface
• Removed CreateACL method from create_acl.go (kept CreateACLs used by Connect)
• Removed DeleteACLs and DeleteACLsResponse from delete_acls.go (kept DeleteACLsKafka used by Connect)
• Removed DescribeQuotas and all QuotaResponse* types from describe_quotas.go (kept DescribeClientQuotas used by Connect)

UI fix surfaced during e2e coverage

• ACL create/update flows now guard navigation on mutation success, fixing a race where the form would navigate away before the Connect RPC completed.

Bug fix (found by adversarial review)

• useCreateACLMutation was invalidating listACLs with cardinality: 'infinite' while the real query uses useQuery (finite). That invalidation silently no-op'd — stale ACL list after every successful create. Pre-existing bug carried forward unexamined; fixed to 'finite' to match the rest of the file.

What's NOT removed (and why)

• GET /api/acls route + handleGetACLsOverview — refreshAcls()/refreshTopicAcls() still populate the Zustand store for isAuthorizerEnabled checks. Full migration requires rearchitecting authorizer detection to use Connect RPC error codes. Tracked for Phase 2 (UX-1210).
• Feature.CreateUser, Feature.DeleteUser, Feature.GetQuotas in supported-features.ts — still used by UI components for feature gating. Tracked for Phase 2 (UX-1210).
• Enterprise Casbin/cloud policy tables still reference deleted routes — dead-match entries, not a security issue (deny-by-default). Tracked for Phase 2 (UX-1210).

Test plan

• go build ./... passes

• bun run type:check passes

• bun run test passes

• Backend lint green

• CI green

• Phase 1 e2e specs run locally against testcontainers — 7/7 passing (verified after tightening assertions). Suite covers:

  • CreateUser toast copy on transport-level network failure and on ALREADY_EXISTS (formatToastErrorMessageGRPC output)
  • DeleteUser toast copy on FAILED_PRECONDITION
  • Quotas INTERNAL Alert (asserted with a 30s timeout to absorb the query-client's exponential-backoff retry policy for Code.Internal)
  • Quotas PERMISSION_DENIED 403 ResultHttpError rendering
  • Cold-cache deep-link to /security/users/<name>/details and /security/acls/<principal>/details (the ACL deeplink seeds a real ACL via AclPage then loads the URL in a fresh browser context)
  • View-only authorization spec gated behind VIEW_ONLY_FIXTURE_READY pending UX-1209

• Users page: create, list, delete users works (via existing Connect RPC)

• ACLs page: create, delete ACLs works (via existing Connect RPC)

• Quotas page: list quotas works (via existing Connect RPC)

• Security page: isAuthorizerEnabled still works (GET /api/acls retained)

---

Note: authorization on ListUsers

The deleted REST GET /api/users enforced admin-only access via Casbin (self-hosted) and cloud policy. The replacement Connect RPC dataplane.v1.UserService.ListUsers uses PERMISSION_VIEW (proto/redpanda/api/dataplane/v1/user.proto:218-220), which lets reader, writer, and admin roles enumerate SASL usernames. This matches every other dataplane List* RPC (topics, ACLs, quotas, consumer groups); the REST admin-only check was a legacy Casbin quirk. Write operations (CreateUser, UpdateUser, DeleteUser) remain PERMISSION_ADMIN. If we want to tighten this back to admin-only, it's a one-line proto annotation change.