Merge feature/keycloak-auth-stack: Phase 6 Keycloak IdP + oauth2-proxy + CNPG (R-IDP-01..06, R-OBS)

# Conflicts:
#	platform-config/kustomization.yaml
#	platform/kustomization.yaml

platform-config/kustomization.yaml

@@ -40,3 +40,17 @@ resources:
   - ../platform/kubevirt/servicemonitor.yaml
   - ../platform/kubevirt/alerts.yaml
   - ../platform/kubevirt/dashboard.yaml
+  # --- Phase 6 — Identity / SSO (ADR-0014) ---
+  # keycloak: the CNPG DB Cluster + Keycloak instance + realm import (CRs of the CNPG / Keycloak
+  # operator CRDs installed by platform/cnpg + platform/keycloak) + its ingress + ServiceMonitor.
+  # ${KEYCLOAK_REPLICAS} in keycloak-instance.yaml is resolved by this Kustomization's substituteFrom.
+  - ../platform/keycloak/postgres-cluster.yaml
+  - ../platform/keycloak/keycloak-instance.yaml
+  - ../platform/keycloak/keycloak-realm-import.yaml
+  - ../platform/keycloak/httproute.yaml
+  - ../platform/keycloak/servicemonitor.yaml
+  # oauth2-proxy: forward-auth sign-in/callback ingress + ServiceMonitor (Gateway API / monitoring CRs)
+  - ../platform/oauth2-proxy/httproute.yaml
+  - ../platform/oauth2-proxy/servicemonitor.yaml
+  # monitoring SSO proof: Grafana native-OIDC login ingress (Gateway API CR)
+  - ../platform/monitoring/grafana-httproute.yaml