feat: update README with instructions for managing API client roles and deletion

  can be told it. It is an address, not a secret.

To grant a product: admin console → realm `oop` → **Users** → the user → **Role mapping** →

**Assign role** → filter by clients → pick the role under `oeg`.

**Assign role** → **Client roles** → pick the role under `oeg`.

To take a product away: unassign the role from the user, **and** from each of their API clients:

**Users** → `service-account-api-…` → **Role mapping** → unassign the `oeg` role. Until you do, their

clients keep that product's scopes. Likewise, disabling or deleting a developer does not stop their

API clients: delete those too ([Stop or remove a developer's API client](#stop-or-remove-a-developers-api-client)).

### Clients

### Give or remove a role

Admin console → realm `oop` → **Users** → the user → **Role mapping** → **Assign role** → filter by

realm roles → pick `operator` or `platform-admin`. To remove one, tick it and choose **Unassign**.

Admin console → realm `oop` → **Users** → the user → **Role mapping** → **Assign role** →

**Realm roles** → pick `operator` or `platform-admin`. To remove one, tick it and choose **Unassign**.

### Stop or remove a developer's API client

API clients are Keycloak clients named `api-<8 characters>`, created by the Portal. Admin console →

realm `oop` → **Clients** → the client.

- **To stop it for good, delete the client** (the **Action** menu). Its token requests are refused

  at once, and the developer can still delete it from the Portal.

- **Do not just turn *Enabled* off if the developer may delete it from the Portal.** Disabling a

  client also stops the Portal from deleting it. The Portal's delete then succeeds, but the

  disabled client stays in Keycloak, and enabling it again brings the old secret back to life. If

  you disabled one, delete it here afterwards.

- To find a developer's clients: each one's `app-provider-id` mapper holds the developer's user id,

  or ask the Portal's database: `SELECT keycloak_client_id, name FROM api_clients WHERE created_by =

  '<user id>' AND deleted_at IS NULL`.

### Put a user in an organization