Add Keycloak IdP / SSO (ADR-0014, docs/15, R-IDP-*)

New identity subsystem, and resolves the C2 auth open question:
- docs/15-identity-and-access.md + ADR-0014: Keycloak as central IdP; native
  OIDC where supported (Gitea, Nextcloud, Grafana, Kasm, Semaphore, Headlamp)
  and oauth2-proxy forward-auth for bare UIs (PiHole, *arr, qBittorrent,
  Homepage, Prometheus, Alertmanager, Hubble). Group-based authz + MFA;
  declarative realm/clients (GitOps); PostgreSQL on Longhorn, DR-critical +
  break-glass; hardened public exposure. Plex/Seerr use Plex auth; Minecraft N/A.
- Requirements R-IDP-01..06; ServiceDefinition gains an  block.
- Onboarded early (with Gitea) so services adopt SSO as they come up.
- Threaded through: docs 00,01,07,10,12,13; roadmap phases+workstreams;
  task board (T-6.1c/T-6.1d); glossary; ADR index; README.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

docs/12-command-center-ui.md

@@ -49,8 +49,10 @@ kubeconfig in a browser:
 
 - The C2 root and its sub-UIs are `internal` exposure by default (LAN-only) unless the operator
   explicitly makes a component `public`.
-- Authentication in front of the C2 (and sensitive sub-UIs like Headlamp) — SSO/reverse-proxy auth —
-  is required; the mechanism (e.g. an identity-aware proxy) is pinned during the C2 workstream.
+- Authentication is via **Keycloak SSO** ([15](15-identity-and-access.md), [ADR-0014](../decisions/adr-0014-idp-keycloak.md)):
+  Headlamp/Grafana use **native OIDC**; UIs without OIDC (Homepage, Prometheus, Alertmanager, Hubble)
+  sit behind the **oauth2-proxy forward-auth** at the Gateway. Access to the C2 and sensitive
+  surfaces requires an authenticated user **in an authorized group** with **MFA** (R-IDP-06).
 - Trusted TLS on the root and all sub-UIs ([08](08-tls-and-certificates.md)).
 
 ## Acceptance gates
@@ -59,6 +61,9 @@ kubeconfig in a browser:
 - Platform health (nodes, storage, Flux, certs, backups, VPN) is visible without leaving the C2.
 - Safe operational actions work and are access-controlled + audited; destructive actions confirm.
 
+## Resolved
+- Auth mechanism — **Keycloak SSO** (native OIDC + oauth2-proxy forward-auth), [15](15-identity-and-access.md) /
+  [ADR-0014](../decisions/adr-0014-idp-keycloak.md).
+
 ## Open questions
-- Auth mechanism for the C2 (identity-aware proxy vs per-app auth) — pin in the C2 workstream.
 - Custom portal vs. Homepage-as-root long term (ADR if we diverge from Homepage).