keycloak: coverage tests + dashboard + reword cross-cutting tags

platform/monitoring/alerts.yaml

@@ -226,7 +226,7 @@ spec:
             severity: critical
           annotations:
             summary: "Egress VPN tunnel down"
-            description: "The egress-gateway VPN tunnel is down (or its metric is absent) for 5m — outbound traffic could leak or stall (R-SEC-03 leak risk)."
+            description: "The egress-gateway VPN tunnel is down (or its metric is absent) for 5m — outbound traffic could leak or stall (leak risk, docs/07)."
             runbook_url: "https://home.keithjackson.dev/runbooks/vpn-down"
         # (ADR-0015) The former `EgressGatewayUnhealthy` pod-readiness alert was REMOVED with the gluetun
         # retirement: there is no in-cluster egress-gateway pod anymore (the tunnel is a host systemd
@@ -241,7 +241,7 @@ spec:
             severity: warning
           annotations:
             summary: "Spike in policy-denied network flows"
-            description: "Policy-denied flow rate is elevated for 10m — a NetworkPolicy regression or an intrusion probe (R-SEC-03)."
+            description: "Policy-denied flow rate is elevated for 10m — a NetworkPolicy regression or an intrusion probe (security audit, docs/07)."
             runbook_url: "https://home.keithjackson.dev/runbooks/denied-flows"
 
 # =====================================================================================