Migrate from oauth2-proxy to keycloak-js + NGINX reverse proxy

Migrating from oauth2‑proxy to Keycloak‑JS behind an NGINX reverse proxy will give our web apps far more flexibility as they grow. Today, oauth2‑proxy mainly acts as a convenient authentication gate in front of the apps, but that same simplicity becomes a limitation: the applications themselves have little awareness of user identity, cannot influence login flows, and cannot offer richer UX around authentication. By shifting to Keycloak‑JS, the apps can directly participate in auth, understand who is logged in, and support more advanced flows such as conditional redirects, role‑based UI, and smoother session handling. NGINX will still provide the reverse‑proxy capabilities we originally adopted oauth2‑proxy for, but without constraining how authentication evolves inside the applications. This migration positions us for better user experience, more sophisticated app behaviour, and a cleaner long‑term architecture.

- Change base helm chart to not depend on oauth2 proxy
- Instead an NGINX sidecar with configuration derived from upstream declarations in app-level helm charts (try to keep those untouched!)
- Define an ingress pointing to the UI and to the aforementioned sidecar matching '/' and '/api' respectively
- Switch existing apps to keycloak-js ([through sci-react-ui](https://diamondlightsource.github.io/sci-react-ui/?path=/docs/helpers-auth--docs)). Note that existing keycloak clients need to be made public (needs UAS tickets).
- Document the procedure for new apps