Add keycloak project: realm import, resource server with realm and client role mapping, audience and issuer traps, method security, admin client

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01VRLbHYdXVEBzGVhYq3pz4q

keycloak/src/main/resources/application.yml

@@ -0,0 +1,17 @@
+keycloak:
+  url: ${KEYCLOAK_URL:http://localhost:8180}
+  realm: demo
+  admin:
+    client-id: admin-svc
+    # The demo secret from realm/demo-realm.json. Real deployments read this from a secret store.
+    client-secret: ${KEYCLOAK_ADMIN_SECRET:admin-svc-demo-secret}
+
+spring:
+  security:
+    oauth2:
+      resourceserver:
+        jwt:
+          # The issuer must match the token's iss claim character for character, host included.
+          issuer-uri: ${keycloak.url}/realms/${keycloak.realm}
+          # Rejects tokens whose aud claim does not contain this value.
+          audiences: spring-api