Add Keycloak IdP / SSO (ADR-0014, docs/15, R-IDP-*)

New identity subsystem, and resolves the C2 auth open question:
- docs/15-identity-and-access.md + ADR-0014: Keycloak as central IdP; native
  OIDC where supported (Gitea, Nextcloud, Grafana, Kasm, Semaphore, Headlamp)
  and oauth2-proxy forward-auth for bare UIs (PiHole, *arr, qBittorrent,
  Homepage, Prometheus, Alertmanager, Hubble). Group-based authz + MFA;
  declarative realm/clients (GitOps); PostgreSQL on Longhorn, DR-critical +
  break-glass; hardened public exposure. Plex/Seerr use Plex auth; Minecraft N/A.
- Requirements R-IDP-01..06; ServiceDefinition gains an  block.
- Onboarded early (with Gitea) so services adopt SSO as they come up.
- Threaded through: docs 00,01,07,10,12,13; roadmap phases+workstreams;
  task board (T-6.1c/T-6.1d); glossary; ADR index; README.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

roadmap/phases.md

@@ -76,8 +76,10 @@ survives rebuild; default-deny + `egress` apply to the VM; guest auto-updates.
 
 ## Phase 6 — Service Catalog Onboarding + C2 UI
 **Entry:** Phases 2–4 done.
-**Do:** onboard the 13 services via ServiceDefinitions in dependency order (see workstream WS-APPS);
-**bring Gitea online early in this phase** and cut the GitOps source + CI/CD over to it (Gitea
+**Do:** onboard the 14 services via ServiceDefinitions in dependency order (see workstream WS-APPS);
+**bring Gitea and Keycloak online early in this phase** — Keycloak is the foundational IdP so
+services adopt SSO (native OIDC / forward-auth) as they onboard ([`../docs/15-identity-and-access.md`](../docs/15-identity-and-access.md));
+and cut the GitOps source + CI/CD over to Gitea (Gitea
 Actions running the Kyverno gate + Chainsaw conformance Job; PRs as the enforced merge gate —
 [`../docs/05-gitops-and-delivery.md`](../docs/05-gitops-and-delivery.md), [`../CONTRIBUTING.md`](../CONTRIBUTING.md));
 stand up the C2 UI (Homepage root + Grafana + Headlamp + Flux status).

roadmap/workstreams.md

@@ -11,7 +11,7 @@ only via [`../agents/coordination-protocol.md`](../agents/coordination-protocol.
 | **WS-GITOPS** | GitOps, CI, catalog renderer | [05](../docs/05-gitops-and-delivery.md), [13](../docs/13-service-catalog.md) | R-GITOPS-*, R-UPD-02 | WS-INFRA |
 | **WS-NET** | Networking, isolation, egress, ingress | [03](../docs/03-networking-isolation-and-egress.md), [09](../docs/09-dns-and-ingress.md) | R-NET-*, R-DNS-* | WS-INFRA |
 | **WS-STORAGE** | Storage, state, backup/DR | [04](../docs/04-storage-and-state.md) | R-STATE-* | WS-INFRA |
-| **WS-SEC** | Secrets, TLS, RBAC, auditability | [07](../docs/07-security-and-secrets.md), [08](../docs/08-tls-and-certificates.md) | R-SEC-*, R-TLS-* | WS-INFRA, WS-NET |
+| **WS-SEC** | Secrets, TLS, RBAC, **identity/SSO**, auditability | [07](../docs/07-security-and-secrets.md), [08](../docs/08-tls-and-certificates.md), [15](../docs/15-identity-and-access.md) | R-SEC-*, R-TLS-*, R-IDP-* | WS-INFRA, WS-NET |
 | **WS-OBS** | Observability & alerting | [10](../docs/10-observability-and-alerting.md) | R-OBS-* | WS-INFRA, WS-STORAGE |
 | **WS-UPDATE** | Automated updates | [11](../docs/11-automated-updates.md) | R-UPD-* | WS-GITOPS, WS-OBS |
 | **WS-VM** | KubeVirt IaaS | [06](../docs/06-vm-workloads-kubevirt.md) | R-PLAT-03 | WS-NET, WS-STORAGE |
@@ -34,6 +34,9 @@ only via [`../agents/coordination-protocol.md`](../agents/coordination-protocol.
   dashboards. Consumed by WS-APPS/WS-VM.
 - **Update policy contract** (WS-UPDATE) — ImagePolicy/Renovate conventions a ServiceDefinition's
   `update` block maps to.
+- **SSO/auth contract** (WS-SEC) — how a ServiceDefinition's `auth` block (oidc / forward-auth /
+  native / groups) maps to a Keycloak client or oauth2-proxy protection ([15](../docs/15-identity-and-access.md)).
+  Consumed by WS-APPS/WS-C2.
 - **Conformance harness + gate** (WS-TEST) — the reproducible test framework (**Kyverno** for L0
   policy, **Chainsaw** for L1/L2/L3 behavior + fault-injection, [ADR-0011](../decisions/adr-0011-test-tooling-kyverno-chainsaw.md)),
   requirement-coverage report, and CI/phase gates every workstream's tests plug into. Each workstream
@@ -55,10 +58,16 @@ only via [`../agents/coordination-protocol.md`](../agents/coordination-protocol.
    and CI/CD; after it is stable, WS-GITOPS cuts Flux's source over to Gitea and moves CI to Gitea
    Actions ([`../docs/05-gitops-and-delivery.md`](../docs/05-gitops-and-delivery.md),
    [`../CONTRIBUTING.md`](../CONTRIBUTING.md)). DR-critical → off-cluster backup + mirror. →
-3. **plex** (largest; validates bulk tier + public exposure) →
-4. **qbittorrent, jackett** (VPN + kill-switch proof) → 5. **sonarr, radarr** (VPN + arr↔downloader
-allows) → 6. **seerr** (cross-service allows to arr + plex) → 7. **nextcloud** (DR-critical data +
-backups) → 8. **minecraft, unifi, semaphore, kasm** (remaining).
+3. **keycloak (+ oauth2-proxy)** — **foundational IdP/SSO**, brought online early so later services
+   integrate SSO as they onboard ([`../docs/15-identity-and-access.md`](../docs/15-identity-and-access.md)).
+   DR-critical + break-glass path. →
+4. **plex** (largest; validates bulk tier + public exposure) →
+5. **qbittorrent, jackett** (VPN + kill-switch proof) → 6. **sonarr, radarr** (VPN + arr↔downloader
+allows) → 7. **seerr** (cross-service allows to arr + plex) → 8. **nextcloud** (DR-critical data +
+backups) → 9. **minecraft, unifi, semaphore, kasm** (remaining).
+
+As each service onboards, it adopts SSO per its `auth` mode (native OIDC or forward-auth) —
+[`../docs/15-identity-and-access.md`](../docs/15-identity-and-access.md).
 
 **GitOps source migration** (WS-GITOPS, tied to step 2): local bootstrap source → self-hosted Gitea;
 CI (Kyverno gate + Chainsaw conformance Job trigger) moves to Gitea Actions; PRs become the enforced