refactor(metadata): drop geoserver config refs

AUTHENTICATION_AND_USER_MANAGEMENT.md

@@ -51,22 +51,18 @@ Project configuration:
 - `PUT /api/v1/admin/projects/{project_id}/databases`
 - `DELETE /api/v1/admin/projects/{project_id}/databases/{db_role}`
 - `POST /api/v1/admin/projects/{project_id}/databases/{db_role}/health`
-- `GET /api/v1/admin/projects/{project_id}/geoserver`
-- `PUT /api/v1/admin/projects/{project_id}/geoserver`
 
 ## Secret Handling
 
-Admins submit plaintext DSNs and GeoServer passwords only through HTTPS admin
-APIs. Operators should not write encrypted columns manually.
+Admins submit plaintext DSNs only through HTTPS admin APIs. Operators should not
+write encrypted columns manually.
 
 - `project_databases.dsn_encrypted` is encrypted with `DATABASE_ENCRYPTION_KEY`.
-- `project_geoserver_configs.gs_admin_password_encrypted` is encrypted with
-  `ENCRYPTION_KEY`.
-- Admin responses return only `has_dsn` or `has_password`.
+- Admin responses return only `has_dsn`.
 - Audit logs record whether a secret was updated, but never store plaintext DSNs
-  or passwords.
+  or other secrets.
 
-Generate both keys with:
+Generate the database encryption key with:
 
 ```bash
 python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
@@ -83,13 +79,12 @@ Apply metadata patches in order:
 2. `resources/sql/005_metadata_project_configuration.sql`
 
 `004` creates Keycloak-backed metadata users and project memberships. `005`
-creates project, project database routing, and GeoServer configuration tables
-with uniqueness, role/type, and pool-size constraints.
+creates project and project database routing tables with uniqueness, role/type,
+and pool-size constraints.
 
 ## Frontend System Management
 
 `/system-admin` is shown only after `GET /api/v1/admin/me` confirms metadata
 admin access. The page lets admins maintain metadata users, project members,
 projects, project database routing for `biz_data` and `iot_data`, connection
-health checks, and GeoServer config. This replaces direct SQL editing for normal
-project onboarding.
+health checks. This replaces direct SQL editing for normal project onboarding.

app/api/v1/endpoints/admin_metadata.py

@@ -270,7 +270,7 @@ async def create_admin_project(
     except IntegrityError as exc:
         raise HTTPException(
             status_code=status.HTTP_409_CONFLICT,
-            detail="Project code or GeoServer workspace conflicts with an existing project",
+            detail="Project code or workspace conflicts with an existing project",
         ) from exc
     except SQLAlchemyError as exc:
         raise HTTPException(
@@ -307,7 +307,7 @@ async def update_admin_project(
     except IntegrityError as exc:
         raise HTTPException(
             status_code=status.HTTP_409_CONFLICT,
-            detail="Project code or GeoServer workspace conflicts with an existing project",
+            detail="Project code or workspace conflicts with an existing project",
         ) from exc
     except SQLAlchemyError as exc:
         raise HTTPException(