Self-hosted identity provider integration

Current authentication is dev-grade: locally-issued HS256 JWTs, bcrypt passwords in a local table, no MFA, refresh, revocation, or federation. Not fit for production.

Auth is easy to get subtly wrong. Use a dedicated, self-hosted tool (likely Keycloak) instead of rolling our own.

## Expected outcome
- The IdP owns identity and issues all tokens.
- The backend only validates IdP-issued tokens.
- Login goes through the IdP.
- Token claims are rich enough to support future authorization.
- The local password login path is gone.

## Out of scope
- Authorization rules — tracked separately.