Merge feature/keycloak-auth-stack: Phase 6 Keycloak IdP + oauth2-proxy + CNPG (R-IDP-01..06, R-OBS)

# Conflicts:
#	platform-config/kustomization.yaml
#	platform/kustomization.yaml

platform/kustomization.yaml

@@ -23,11 +23,15 @@ resources:
   - vpn-egress         # CiliumEgressGatewayPolicy steering egress-class=vpn pods to the node tun0 (ADR-0015)
   # ---- Phase 4 — Observability (creds provisioned via SOPS: grafana-admin, alertmanager-smtp) ----
   - monitoring         # kube-prometheus-stack + Loki + Alloy + Alertmanager
+  # ---- Phase 6 — Identity / SSO (ADR-0014): foundational IdP, onboarded early. Keycloak Operator +
+  #      CloudNativePG DB + oauth2-proxy forward-auth. Controllers here; the Keycloak/RealmImport/CNPG
+  #      Cluster CRs + ServiceMonitors + HTTPRoutes are in platform-config (dependsOn platform). ----
+  - cnpg               # CloudNativePG operator (DB backend for Keycloak) — ghcr.io images (not Bitnami)
+  - keycloak           # Keycloak Operator (quay.io images) + SOPS admin credential
+  - oauth2-proxy       # forward-auth for non-OIDC UIs — needs SOPS `oauth2-proxy-credentials` (hand-off)
   # ---- Later phases: enabled when their phase opens ----
   # - velero           # Phase 4 (Backup/DR): BLOCKED on OQ-BKP (off-cluster backup target decision)
   # - image-automation # Phase 4 (Automated updates): Flux image-automation + Renovate
   # ---- Phase 5 — IaaS proof (KubeVirt): operator CONTROLLERS only; the KubeVirt/CDI CRs +
   #      ServiceMonitors/alerts/dashboard are applied by platform-config (dependsOn platform, F-MON1). ----
   - kubevirt           # KubeVirt + CDI operators (register kubevirt.io / cdi.kubevirt.io CRDs)
-  # - keycloak         # Phase 6 (Catalog + C2 UI): foundational IdP — needs SOPS `keycloak-admin-credentials`
-  # - oauth2-proxy     # Phase 6: forward-auth — needs SOPS `oauth2-proxy-credentials`