[Ticket]: Claude Code OAuth2 integration with our gateway

### Type
Feature

### Summary
We need Claude Code users to be able to complete an OAuth2 flow against our issuer (Keycloak) to obtain API keys, then talk to our Anthropic-compatible gateway. Expected result: a Claude Code user can authenticate via OAuth2 against our issuer and use our gateway, following Claude Code's documented authentication precedence.

### Intent
Let Claude Code users authenticate the same way our other agent clients do (real OAuth2 against our issuer), consistent with this repo's Keycloak-JWT-is-the-boundary model (ADR-0021), rather than relying on manually-issued static keys.

### Source of truth (links)
https://code.claude.com/docs/en/authentication#authentication-precedence
Sprint planning session, 2026-07-11 (local planning doc — no public source-of-truth link yet).

### Current Behavior
N/A — new integration. Gateway currently authenticates via Keycloak JWT (ADR-0021); no documented Claude-Code-specific OAuth2 flow exists yet.

### Expected Behavior
A Claude Code user completes an OAuth2 flow against our Keycloak issuer per Claude Code's documented auth-precedence rules, and can make authenticated requests to our Anthropic-compatible endpoints.

### Acceptance Criteria
- [ ] Given Claude Code's documented authentication precedence, when our gateway + Keycloak are configured to fit into it, then a Claude Code user can complete the OAuth2 flow.
- [ ] Given a completed flow, when the user sends a request via Claude Code, then it's authenticated and routed the same as any other Keycloak-authenticated client.
- [ ] Verification evidence is provided (see below).

### Out of Scope
The Codex/ChatGPT plugin (tracked as a separate ticket) — this ticket is Claude-Code-specific.

### Technical Context
Keycloak realm/client config: `charts/keycloak-baseline`. Gateway auth boundary: ADR-0021 (`docs/adr/0021-*.md`). Will likely need a new Keycloak client registration matching whatever auth method Claude Code's precedence order expects (env var, config file, or native OAuth login flow — confirm which against the linked doc).

### Test Plan
TBD by ticket owner — configure Claude Code per the linked doc against a test Keycloak client, confirm end-to-end auth + a successful request.

### Verification evidence
N/A — not yet implemented. To be filled in by the ticket owner on completion.

### Human accountable owner
TBD — to be assigned during sprint planning.

### AI Usage Declaration
Drafting the ticket

### Human verification completed
(unchecked — pending assignment and human review)