Add Keycloak IdP / SSO (ADR-0014, docs/15, R-IDP-*)

New identity subsystem, and resolves the C2 auth open question:
- docs/15-identity-and-access.md + ADR-0014: Keycloak as central IdP; native
  OIDC where supported (Gitea, Nextcloud, Grafana, Kasm, Semaphore, Headlamp)
  and oauth2-proxy forward-auth for bare UIs (PiHole, *arr, qBittorrent,
  Homepage, Prometheus, Alertmanager, Hubble). Group-based authz + MFA;
  declarative realm/clients (GitOps); PostgreSQL on Longhorn, DR-critical +
  break-glass; hardened public exposure. Plex/Seerr use Plex auth; Minecraft N/A.
- Requirements R-IDP-01..06; ServiceDefinition gains an  block.
- Onboarded early (with Gitea) so services adopt SSO as they come up.
- Threaded through: docs 00,01,07,10,12,13; roadmap phases+workstreams;
  task board (T-6.1c/T-6.1d); glossary; ADR index; README.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

docs/07-security-and-secrets.md

@@ -16,6 +16,11 @@ Defense in depth with declarative, auditable controls:
 - **TLS**: trusted, auto-managed certificates end to end ([08](08-tls-and-certificates.md), R-TLS-*).
 - **Supply chain**: pin images by digest where automation allows; prefer known-good upstreams;
   updates flow through policy, not ad-hoc pulls ([11](11-automated-updates.md)).
+- **Identity / SSO**: a central IdP (**Keycloak**) provides single sign-on, one user directory,
+  group-based authorization, and MFA; services authenticate via native OIDC or an oauth2-proxy
+  forward-auth layer so no management UI is unauthenticated ([15](15-identity-and-access.md),
+  [ADR-0014](../decisions/adr-0014-idp-keycloak.md), R-IDP-*). This is the primary *authentication*
+  control, complementing network default-deny (the primary *isolation* control).
 - **Policy enforcement (admission)**: **Kyverno** runs in-cluster as an admission controller and
   rejects non-conforming resources at reconcile time — e.g. a namespace missing its default-deny
   baseline, a plaintext Secret, a workload without a required egress-class label. The *same* policies
@@ -37,6 +42,7 @@ Defense in depth with declarative, auditable controls:
 
 ### Secret categories to manage
 - VPN credentials (PIA username/password; WireGuard) for the egress model (ADR-0013).
+- Keycloak admin credential and per-service **OIDC client secrets** ([15](15-identity-and-access.md)).
 - DNS provider API token (Cloudflare) for ACME DNS-01 + ExternalDNS.
 - SMTP credentials for Alertmanager email.
 - Service credentials (Nextcloud, Gitea admin, UniFi, Semaphore, Kasm, DB passwords).