feat(keycloak): enable offline_access for kubernetes OIDC client

Add the offline_access optional client scope to the `kubernetes`
kubelogin client so the operator's kubectl can request long-lived
OFFLINE refresh tokens (--oidc-extra-scope=offline_access) instead of
being forced to re-auth on the realm's ONLINE session timeouts
(ssoSessionIdleTimeout 30m / ssoSessionMaxLifespan 10h). Offline tokens
honour offlineSessionIdleTimeout 30d with no hard max lifespan.

- keycloak-realm-import.yaml: add optionalClientScopes: [offline_access]
  to the kubernetes client so a fresh realm import reproduces it.
- k8s-oidc-rbac.yaml: document the kubeconfig exec-arg
  (--oidc-extra-scope=offline_access) + clear-cache/re-login steps.

Realm session timeouts unchanged; scope is optional (opt-in) and
client-only. Applied live via kcadm (reversible).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/keycloak/keycloak-realm-import.yaml

@@ -151,6 +151,14 @@ spec:
           - email
           - profile
           - roles
+        # offline_access (optional): lets kubelogin request a long-lived OFFLINE refresh token via
+        # `--oidc-extra-scope=offline_access`, so the operator's kubectl isn't forced to re-auth on the
+        # ONLINE session idle/max timeouts (ssoSessionIdleTimeout 30m / ssoSessionMaxLifespan 10h).
+        # Offline tokens honour offlineSessionIdleTimeout (30d) with offlineSessionMaxLifespanEnabled=false
+        # (no hard cap) — see k8s-oidc-rbac.yaml header for the kubeconfig exec-arg. Optional (not default)
+        # so it is opt-in per the client's request scopes; realm session timeouts stay unchanged.
+        optionalClientScopes:
+          - offline_access
         protocolMappers:
           - name: groups
             protocol: openid-connect