Add Keycloak IdP / SSO (ADR-0014, docs/15, R-IDP-*)

New identity subsystem, and resolves the C2 auth open question:
- docs/15-identity-and-access.md + ADR-0014: Keycloak as central IdP; native
  OIDC where supported (Gitea, Nextcloud, Grafana, Kasm, Semaphore, Headlamp)
  and oauth2-proxy forward-auth for bare UIs (PiHole, *arr, qBittorrent,
  Homepage, Prometheus, Alertmanager, Hubble). Group-based authz + MFA;
  declarative realm/clients (GitOps); PostgreSQL on Longhorn, DR-critical +
  break-glass; hardened public exposure. Plex/Seerr use Plex auth; Minecraft N/A.
- Requirements R-IDP-01..06; ServiceDefinition gains an  block.
- Onboarded early (with Gitea) so services adopt SSO as they come up.
- Threaded through: docs 00,01,07,10,12,13; roadmap phases+workstreams;
  task board (T-6.1c/T-6.1d); glossary; ADR index; README.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

GLOSSARY.md

@@ -58,6 +58,20 @@ two things (e.g. "VM"), this file disambiguates.
 - **cert-manager / ACME DNS-01 / Let's Encrypt** — the trusted, automated TLS pipeline (R-TLS-*).
 - **ExternalDNS** — controller that publishes DNS records from declared service intent.
 
+## Identity & access
+- **IdP (Identity Provider)** — the central authority for user identity and login. Here: **Keycloak**
+  ([`docs/15-identity-and-access.md`](docs/15-identity-and-access.md)).
+- **SSO (Single Sign-On)** — log in once, reach every integrated service without re-authenticating.
+- **OIDC (OpenID Connect)** — the token-based auth protocol services use to federate to Keycloak
+  natively (a Keycloak **client**).
+- **Forward-auth** — an identity-aware proxy (**oauth2-proxy**) at the Gateway that authenticates a
+  request against Keycloak before forwarding it — used for apps without native OIDC.
+- **Realm** — a Keycloak tenant/namespace holding the platform's users, groups, and clients.
+- **Group** — a Keycloak grouping that drives per-service authorization (`auth.groups` in a
+  ServiceDefinition); the basis for least-privilege access (R-IDP-06).
+- **Break-glass** — a documented emergency access path (e.g. a local admin on Gitea) so an IdP outage
+  doesn't lock the operator out of recovery tools.
+
 ## Environments
 - **dev/test** — local KVM cluster; the active build target where everything is proven.
 - **prod** — 3× mini-PC bare-metal cluster; design-only until roadmap Phase 7.