keycloak: coverage tests + dashboard + reword cross-cutting tags

platform/keycloak/keycloak-realm-clients.sops.yaml.example

@@ -5,7 +5,7 @@
 # WHAT THIS IS: the OIDC client secrets for the two confidential clients the realm import
 # (keycloak-realm-import.yaml) provisions — grafana and oauth2-proxy. The realm import injects
 # these values via spec.placeholders ($(env:GRAFANA_CLIENT_SECRET) / $(env:OAUTH2_PROXY_CLIENT_SECRET)),
-# so the client secrets live ONLY here (SOPS-encrypted), never in the realm YAML (R-SEC-01 / R-IDP-04).
+# so the client secrets live ONLY here (SOPS-encrypted), never in the realm YAML (R-IDP-04; docs/07).
 #
 # HAND-OFF STEPS (operator):
 #  (a) Generate two client secrets: