feat: enhance Keycloak integration with initial admin user and audience...

  ask a platform administrator. An admin resets the password in the admin console: Users → the user →

  Credentials → Reset password, marked *Temporary* so the user picks a new one at the next login.

  Logged-in users change their own password through the portal (`kc_action=UPDATE_PASSWORD`).

- Every install creates a first `platform-admin` user, `oop-admin`, so someone can log in and manage

  users on a cluster without sample users. Its password is generated into `keycloak-credentials` →

  `initial-admin-password` and is temporary: the first login asks for a new one. Turn it off with

  `keycloak.realms.oop.initialAdmin.enabled: false`.

- The admin password and the `oop-portal` client secret are generated on first install into Secret

  `keycloak-credentials`, which is kept on `helm uninstall` because the realms keep using them. Pin them

  with `keycloak.admin.password` / `keycloak.realms.oop.portal.clientSecret` in `secrets.values.yaml`.

Federation Manager validates every incoming bearer token against Keycloak's realm `federation`:

signature (keys fetched from `http://<host>:<port>/realms/<realm>`), expiry, issuer, and the

`fed-mgmt` scope. Invalid or missing tokens get `401`. The expected issuer is discovered from

Keycloak's discovery document at that same address, so it follows Keycloak's public URL with no

extra configuration.

`fed-mgmt` scope, and the audience `federation-manager` (the keycloak chart adds it to the partner

clients; `global.federation.audience`). Invalid or missing tokens get `401`; when Keycloak itself

cannot be reached, requests get `503` instead. The expected issuer is discovered from Keycloak's

discovery document at that same address, so it follows Keycloak's public URL with no extra

configuration.

```yaml

federationManager:

      # Issuer Keycloak puts in tokens (`iss`), also the token URL the Swagger UI shows.

      # Empty = discovered from Keycloak; set it only to override that.

      issuer: ""

      # Audience partner tokens must carry. Empty = global.federation.audience,

      # else federation-manager.

      audience: ""

```

The client IDs and secrets must match the clients in Keycloak's `federation` realm.

| `federationManager.service.nodePort` | NodePort for Federation Manager | `30989` |

| `federationManager.config.keycloak.host` / `port` / `realm` | Where Federation Manager reaches Keycloak | `keycloak` / `8080` / `federation` |

| `federationManager.config.keycloak.issuer` | Override for the issuer expected in tokens | `""` (discovered from Keycloak) |

| `federationManager.config.keycloak.audience` | Audience partner tokens must carry | `""` (`global.federation.audience`, else `federation-manager`) |

| `federationManager.config.keycloak.existingSecret` | Secret holding the partner client secrets | `""` (umbrella: `keycloak-credentials`) |

| `federationManager.config.partner_op.role` | Role: `partner_op` or `originating_op` | `partner_op` |

| `openvpn.enabled` | Enable OpenVPN sidecar | `false` |

| `openvpn.secretName` | Name of VPN secret | `partner-ovpn` |

{{- end -}}

{{- end }}

{{/*

Audience partner tokens must carry (the keycloak chart adds it to the federation clients).

*/}}

{{- define "federation-manager.audience" -}}

{{- .Values.federationManager.config.keycloak.audience | default (dig "federation" "audience" "federation-manager" (.Values.global | default dict)) -}}

{{- end }}

{{/*

Secret holding the client secrets: `existingSecret` (e.g. keycloak-credentials, filled by the

keycloak chart, keys federation-<client id>-secret) or this chart's own Secret.

    port = {{ include "federation-manager.keycloak.port" . }}

    realm = {{ .Values.federationManager.config.keycloak.realm }}

    issuer = {{ .Values.federationManager.config.keycloak.issuer }}

    audience = {{ include "federation-manager.audience" . }}

    [server]

    host = {{ .Values.federationManager.config.server.host }}

      # Swagger UI. Empty = discovered from Keycloak's discovery document at

      # http://<host>:<port>/realms/<realm>; set it only to override that.

      issuer: ""

      # Audience partner tokens must carry. Empty = global.federation.audience, else

      # federation-manager.

      audience: ""

    server:

      host: "127.0.0.1"