Remove internal notification caller tokens

docs/local-development.md

@@ -39,7 +39,6 @@ kv/
 ├── services/
 │   ├── bff/jwt                         # jwt
 │   └── notifications/
-│       ├── callers/bff                 # token; read by BFF and notifications
 │       └── email/resend                # api_key only
 └── infrastructure/
     ├── nats/auth                       # token; read by NATS and notifications
@@ -56,7 +55,7 @@ password is rotated immediately after initial configuration.
 
 There are no frontend certificates, notification certificates or generic `tls`
 entries in KV. Browser certificates belong to Caddy; internal gRPC is plaintext
-on the private Docker network and retains caller-token authentication.
+on the trusted private Docker network without caller authentication.
 
 ## Resend
 
@@ -114,7 +113,7 @@ Trust installation is not automated. A CLI check can use:
 curl --cacert .local/dev/ca.pem https://localhost:5126/api/v1/health
 ```
 
-BFF calls notifications over plaintext gRPC with its caller token. Mongo and NATS
+BFF calls notifications over plaintext gRPC without caller authentication. Mongo and NATS
 also stay within the private Compose network; no internal service publishes a host
 port. Only frontend and Vault bind host loopback ports. TLS remains optional in
 the reusable notification client/server for deployments that explicitly configure
@@ -143,7 +142,7 @@ still interrupt work. Repository consumers use `source.Source` operation scopes;
 
 ## Migration and persistence
 
-Bootstrap migrates the old flat `bff`, `caller`, `email` and `nats` paths into the
+Bootstrap migrates the old flat `bff`, `email` and `nats` paths into the
 hierarchy above, and moves `bootstrap/mongo` to `infrastructure/mongo/bootstrap`.
 It copies with CAS protection, compares values, and refuses to
 overwrite conflicting destinations. After consumers use the new paths, it removes
@@ -178,3 +177,6 @@ and requires three replacements with unchanged BFF PID and zero unexpected
 transaction-backed HTTP responses. It restores TTLs and removes services it
 started. No verification command sends email. Backend validation remains
 `make test` and `make lint-backend`, using the host SDKs documented in module guides.
+
+Bootstrap archives and removes obsolete `caller` and `services/notifications/callers/bff`
+KV entries after updating Agent policies/templates. NATS authentication remains enabled.