T-0.1 Flux GitOps layout + dev/prod overlays + platform component skeletons (R-GITOPS-01/03, R-ENV-02, R-PLAT-01)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/keycloak/helmrelease.yaml

@@ -0,0 +1,40 @@
+---
+# Keycloak — platform IdP (OIDC + SAML), config-as-code, PostgreSQL on Longhorn (ADR-0014).
+# Phase 0 STUB. DR-CRITICAL: DB backed up off-cluster; documented break-glass local-admin path.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: keycloak
+  namespace: keycloak
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: keycloak
+      version: ">=24.0.0 <25.0.0"   # TODO(WS-SEC): pin at bring-up; Renovate maintains
+      sourceRef:
+        kind: HelmRepository
+        name: bitnami
+        namespace: keycloak
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    replicaCount: ${KEYCLOAK_REPLICAS}       # overlay knob: dev 1 / prod 2 (HA) — R-ENV-02
+    production: true                          # TLS/proxy-aware; served behind the Gateway (public)
+    proxyHeaders: xforwarded
+    # PostgreSQL on Longhorn (ADR-0014) — DR-critical, backed up off-cluster (velero/).
+    postgresql:
+      enabled: true
+      primary:
+        persistence:
+          storageClass: longhorn
+    # Admin + DB credentials: SOPS-encrypted secrets referenced BY NAME only (WS-SEC, ADR-0007).
+    auth:
+      existingSecret: keycloak-admin-credentials
+    # TODO(WS-SEC, Phase 6): realms/clients/groups as code (keycloak-config-cli / realm-import);
+    #   MFA for privileged groups; break-glass local-admin path (e.g. on Gitea). Onboarded EARLY
+    #   (with PiHole/Gitea) so later services adopt SSO as they come up (roadmap Phase 6).