User accounts: login and Galaxy identity integration (Keycloak BFF)

# Overview

BRC Analytics needs user accounts: users can log in (including with Google), BRC knows the user's associated Galaxy identity, and BRC can securely act on the user's behalf in Galaxy (list histories, check workflow run status, maintain preferences, organize results).

# Chosen approach

Keycloak + Backend-for-Frontend, per the evaluation in #812 (Approach 4):

- **Keycloak** is the central identity provider — handles Google login, user/role provisioning, and token issuance.
- **BRC Analytics (Next.js)** owns the session in encrypted httpOnly cookies and exposes `/api/galaxy/...` routes that proxy the needed Galaxy APIs; tokens never reach the browser.
- **Galaxy** acts as the resource server, validating Keycloak JWTs.

See #812 for the full decision history and the alternatives considered. Note: the original sketch assumed NextAuth; that dependency was later removed (#1247), and the session/auth provider now comes via findable-ui / `@repo/shared`.

Supersedes #812.

Start with the decision history in #812 and the session-provider change in #1247; the issue names no implementation files or tests. Trace the current Next.js session setup and the `/api/galaxy/...` entry points. Done means Google login, Galaxy identity association, and secure proxying of the listed Galaxy operations without exposing tokens.

Written by the indexing model from the issue text.