Migrate Keycloak admin password from user-provided variable to auto-generated Secrets Manager secret

Migrate Keycloak admin password from user-provided variable to auto-generated Secrets Manager secret

## Issue Type
Enhancement / Security Improvement

## Description

### Current Behavior
The Keycloak administrator password is currently:
- Passed as a Terraform variable (`keycloak_admin_password`)
- Marked as sensitive but requires manual generation by the deployer
- Stored in Terraform state (encrypted but still present)
- No automatic rotation capability

**Reference:** `terraform/aws-ecs/variables.tf` line 103-107

```hcl
variable "keycloak_admin_password" {
description = "Keycloak admin password"
type = string
sensitive = true
}
```

### Desired Behavior
The Keycloak admin password should be auto-generated using AWS Secrets Manager, similar to how DocumentDB credentials are handled in the same codebase:

- Generated dynamically at deployment time using `aws_secretsmanager_secret` with `random_password`
- Stored in AWS Secrets Manager (not in Terraform state)
- No manual password input required from deployer
- Automatic rotation capability (Secrets Manager feature)
- Retrieved by ECS tasks via IAM permissions

### Benefits
1. **Security**: Password never appears in Terraform state or user input
2. **Automation**: No need for deployers to generate/manage passwords manually
3. **Rotation**: Secrets Manager provides built-in rotation capabilities
4. **Consistency**: Matches the pattern already used for DocumentDB credentials in this repo
5. **Best Practice**: Aligns with AWS security best practices for credential management

### Proposed Implementation

**In `terraform/aws-ecs/secrets.tf` (or new file):**

```hcl
# Generate random password for Keycloak admin
resource "random_password" "keycloak_admin" {
length = 32
special = true
override_special = "!#$%&*()-_=+[]{}<>:?"
}

# Store in Secrets Manager
resource "aws_secretsmanager_secret" "keycloak_admin_password" {
name = "${var.name}-keycloak-admin-password"
description = "Keycloak administrator password (auto-generated)"

tags = {
Name = "${var.name}-keycloak-admin-password"
Environment = var.name
}
}

resource "aws_secretsmanager_secret_version" "keycloak_admin_password" {
secret_id = aws_secretsmanager_secret.keycloak_admin_password.id
secret_string = random_password.keycloak_admin.result
}
```

**In `terraform/aws-ecs/modules/ecs-services/main.tf`:**

Update Keycloak container environment to retrieve password from Secrets Manager:

```hcl
secrets = [
{
name = "KEYCLOAK_ADMIN_PASSWORD"
valueFrom = var.keycloak_admin_password_secret_arn
}
]
```

**In `terraform/aws-ecs/main.tf`:**

Pass the secret ARN to the ECS services module:

```hcl
module "ecs_services" {
# ... existing config ...

keycloak_admin_password_secret_arn = aws_secretsmanager_secret.keycloak_admin_password.arn
}
```

**Remove from `terraform/aws-ecs/variables.tf`:**

Delete the `keycloak_admin_password` variable (lines 103-107)

**Update IAM permissions:**

Ensure ECS task execution role has `secretsmanager:GetSecretValue` permission for the Keycloak admin password secret.

### Example Reference
The DocumentDB credentials already implement this pattern in the same repository:
- See `terraform/aws-ecs/documentdb.tf` for `aws_secretsmanager_secret.documentdb_credentials`
- See how it's consumed by ECS services via `secrets` block

### Migration Considerations
- **Breaking Change**: Existing deployments using the `keycloak_admin_password` variable would need to remove it from their `terraform.tfvars`
- **Documentation**: Update README and deployment guides to reflect automatic password generation
- **Backward Compatibility**: Consider a transition period where both methods are supported (check if variable is provided, otherwise generate)

### Related Files
- `terraform/aws-ecs/variables.tf` (remove variable)
- `terraform/aws-ecs/secrets.tf` (add secret generation)
- `terraform/aws-ecs/main.tf` (pass secret ARN to modules)
- `terraform/aws-ecs/modules/ecs-services/main.tf` (consume secret)
- `terraform/aws-ecs/README.md` (update documentation)

---

## Additional Context
This issue was identified during workshop development where the inconsistency between manual password management (Keycloak) and automatic password generation (DocumentDB) created confusion and represented a security best practice gap.

The repository already demonstrates the correct pattern with DocumentDB credentials - this issue requests applying the same pattern to Keycloak admin credentials for consistency and improved security.

## Labels
- `enhancement`
- `security`
- `terraform`
- `good first issue` (detailed implementation guidance provided)