Normalize Switchio Key Vault secrets

[thekaveman]

We have this TODO note in SwitchioConfig.client_certificate_data:

benefits/benefits/enrollment_switchio/models.py

Lines 56 to 65 in e9bf8fc

	def client_certificate_data(self):
	"""This SwitchioConfig's client certificate as a string."""
	if self.environment == Environment.DEV.value:
	# Special case to handle un-purgeable cert in Azure dev env Key Vault with the desired `switchio-client-cert` name
	# See: https://cal-itp.slack.com/archives/C037Y3UE71P/p1776806316220499
	# Also affects local setup using standard fixtures with secrets
	# TODO: Remove this special case when the deleted cert is automatically purged on July 20, 2026
	return get_secret_by_name("switchio-int-client-cert")
	return get_secret_by_name("switchio-client-cert")

Today is August 7, 2026 and I can confirm the switchio-client-cert certificate has been purged from the dev Key Vault:

Hence, we can now clean up this code and normalize the cert secrets in the dev Key Vault to match what we do in the test and prod Key Vaults.

Acceptance Criteria

• The secret switchio-int-client-cert is renamed to the standard switchio-client-cert naming convention
• The special case code shown above for switchio-int-client-cert is removed
• TBD there may be some more secret cleanup, needs more research

Additional context

[thekaveman]

@Scotchester I'm tagging you here only because you were the last to work on this area of the code in #3659.

I see many what appear to be duplicate (or even, incorrect?) secrets related to Switchio config in the various Key Vaults. E.g. this selection from dev:

We see:

• switchio-ca-cert (used by the code) and switchio-int-ca-cert
• switchio-private-key (used by the code) and switchio-int-private-key
• switchio-int-enrollment-api-base-url when the code looks for switchio-enrollment-api-base-url (and I don't see that secret...?)

Do you know what is going on here? This is the same situation in test and prod. I'd really like to get this cleaned up.