Add Keycloak IdP / SSO (ADR-0014, docs/15, R-IDP-*)

New identity subsystem, and resolves the C2 auth open question:
- docs/15-identity-and-access.md + ADR-0014: Keycloak as central IdP; native
  OIDC where supported (Gitea, Nextcloud, Grafana, Kasm, Semaphore, Headlamp)
  and oauth2-proxy forward-auth for bare UIs (PiHole, *arr, qBittorrent,
  Homepage, Prometheus, Alertmanager, Hubble). Group-based authz + MFA;
  declarative realm/clients (GitOps); PostgreSQL on Longhorn, DR-critical +
  break-glass; hardened public exposure. Plex/Seerr use Plex auth; Minecraft N/A.
- Requirements R-IDP-01..06; ServiceDefinition gains an  block.
- Onboarded early (with Gitea) so services adopt SSO as they come up.
- Threaded through: docs 00,01,07,10,12,13; roadmap phases+workstreams;
  task board (T-6.1c/T-6.1d); glossary; ADR index; README.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

README.md

@@ -78,7 +78,8 @@ home-network-k3s/
 │   ├── 11-automated-updates.md
 │   ├── 12-command-center-ui.md
 │   ├── 13-service-catalog.md
-│   └── 14-testing-and-conformance.md
+│   ├── 14-testing-and-conformance.md
+│   └── 15-identity-and-access.md
 ├── decisions/                    ← ADRs (one decision per file) + index/template
 ├── roadmap/                      ← phases.md, workstreams.md
 └── agents/                       ← roles, coordination protocol, DoD, task board