Kafka gateway: E2E test for produce and consume over SASL through the bridge #4340

Follow-up to #3549, which carried this as its last acceptance criterion.

Summary

No test runs a real Kafka client that authenticates with SASL and then produces and consumes through the bridge. The SASL tests in gateways/kafka/tests/kafka_client_e2e_tests.rs stop after authenticating and listing metadata, and the Fetch tests in #4336 run with SASL off.

Depends on

• feat(gateways): answer Kafka Fetch with records from Iggy #4336, Fetch answered with records from Iggy. Until it merges, Fetch on master is a stub that answers NOT_LEADER_OR_FOLLOWER (6), so nothing can be consumed.

Scope

• Gateway started with IGGY_KAFKA_SASL_ENABLED=true and the bridge enabled, against a real iggy-server
• kcat produces over SASL_PLAINTEXT and reads the records back in order
• Reuse the kcat produce/consume helpers from feat(gateways): answer Kafka Fetch with records from Iggy #4336 rather than adding parallel ones

Out of scope

Requests still run as the bridge's service account, not as the authenticated principal, so this proves the paths work together, not that permissions are enforced per user. See "Planned: authorization errors" in gateways/kafka/docs/AUTHENTICATION.md.