fix(nextcloud-sso): register post-logout redirect URI + harden admin promotion

Two SSO follow-ups the operator hit after Nextcloud OIDC login worked.

1. Sign-out "redirect failed". On logout user_oidc redirects the browser to
   Keycloak's end_session_endpoint with post_logout_redirect_uri=<Nextcloud
   base '/'> and client_id=nextcloud but NO id_token_hint (provider
   sendIdTokenHint=0). Keycloak then validates that redirect against the
   client's post.logout.redirect.uris attribute, which was empty -> "Invalid
   redirect uri" -> the operator's "redirect failed". Register
   https://nextcloud.home.keithjackson.dev/* on the nextcloud client
   (attributes.post.logout.redirect.uris). Applied live via kcadm and captured
   here so git stays authoritative (a RealmImport no-ops on the existing realm).

2. postStart step (d) mirrors platform-admins -> built-in admin group, but the
   previous single best-effort pass ran occ group:adduser once with output
   swallowed and no retry. At early boot (container Started ~9s after create)
   that call can transiently fail (DB / maintenance race), silently dropping the
   promotion until the next restart. Harden step (d) with a verify-and-retry
   loop (like step (c)): re-read group:list and re-add any platform-admins
   member still missing from admin until verified (bounded ~30s), no-op for
   existing members.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/keycloak/keycloak-realm-import.yaml

@@ -207,6 +207,14 @@ spec:
           - https://nextcloud.home.keithjackson.dev/apps/user_oidc/code
         webOrigins:
           - https://nextcloud.home.keithjackson.dev
+        # Post-logout redirect allow-list (#logout "redirect failed"). On sign-out user_oidc redirects the
+        # browser to Keycloak's end_session_endpoint with post_logout_redirect_uri=<Nextcloud base '/'> and
+        # client_id=nextcloud but NO id_token_hint (provider sendIdTokenHint=0), so Keycloak validates the
+        # redirect against this client attribute — empty => "Invalid redirect uri" => the operator's
+        # "redirect failed". The wildcard covers the base URL and any logout landing path. Keycloak stores
+        # this as the client attribute `post.logout.redirect.uris` (## separates multiple values).
+        attributes:
+          post.logout.redirect.uris: https://nextcloud.home.keithjackson.dev/*
         defaultClientScopes:
           - email
           - profile