Add refresh token support to Keycloak credentials provider

## Summary
The Keycloak credentials provider currently only captures and stores the `access_token` from the OAuth2 token response, but does not capture or store the `refresh_token`. This prevents implementing a token refresh utility that could automatically obtain new access tokens before they expire.

## Current Behavior
The `generate_tokens.py` script:
- Requests tokens from Keycloak using client credentials grant
- Receives both `access_token` and `refresh_token` in the response
- Only extracts and saves the `access_token`
- Discards the `refresh_token` and related metadata

## Expected Behavior
The credentials provider should:
- Extract both `access_token` and `refresh_token` from Keycloak response
- Save both tokens to the `.env` file
- Include both tokens and their expiration metadata in the `.json` file
- Enable a separate utility to refresh access tokens using the refresh token

## Keycloak Response Structure
```json
{
"access_token": "...",
"refresh_token": "...",
"token_type": "Bearer",
"expires_in": 300,
"refresh_expires_in": 1800,
"scope": "openid email profile"
}
```

## Proposed Changes

### 1. Update `save_token_files` method (lines 128-220)
Extract refresh token:
```python
access_token = token_data['access_token']
refresh_token = token_data.get('refresh_token')
expires_in = token_data.get('expires_in')
refresh_expires_in = token_data.get('refresh_expires_in')
```

### 2. Update `.env` file generation (lines 146-156)
Add refresh token:
```bash
export ACCESS_TOKEN="..."
export REFRESH_TOKEN="..."
export CLIENT_ID="..."
export CLIENT_SECRET="..."
export KEYCLOAK_URL="..."
export KEYCLOAK_REALM="..."
export AUTH_PROVIDER="keycloak"
```

### 3. Update `.json` file structure (lines 163-181)
Include refresh token metadata:
```json
{
"agent_name": "...",
"access_token": "...",
"refresh_token": "...",
"token_type": "Bearer",
"expires_in": 300,
"refresh_expires_in": 1800,
"generated_at": "2025-10-03T01:00:00Z",
"expires_at": "2025-10-03T01:05:00Z",
"refresh_expires_at": "2025-10-03T01:30:00Z",
...
}
```

## Benefits
1. Enables token refresh without re-authentication
2. Reduces token expiration issues for long-running processes
3. Allows building a token refresh utility/daemon
4. Improves security by rotating access tokens regularly
5. Minimizes exposure of access tokens

## Use Case
A separate utility can monitor token expiration and automatically refresh:
```python
# Token refresh utility pseudo-code
if access_token_expires_soon():
new_tokens = refresh_access_token(refresh_token)
update_token_files(new_tokens)
```

## Files to Modify
- `/home/ubuntu/repos/mcp-gateway-registry/credentials-provider/keycloak/generate_tokens.py`

## Acceptance Criteria
- [ ] Refresh token is extracted from Keycloak response
- [ ] Refresh token is saved to `.env` file as `REFRESH_TOKEN`
- [ ] Refresh token and `refresh_expires_in` are included in `.json` file
- [ ] Refresh token expiration timestamp is calculated and stored
- [ ] Existing functionality remains unchanged
- [ ] Code follows project coding standards (CLAUDE.md)