[Tracking] Keycloak integration roadmap

## Purpose

This issue tracks the work required to complete and mature Aspire's Keycloak hosting and authentication integrations. The initial integration shipped in #4289; active work is tracked through the sub-issues below.

Narrow regressions should remain standalone issues unless they expose a missing roadmap capability.

## Active roadmap

### Production readiness and connectivity

- [ ] #6004 — production deployment, HTTPS, and reverse-proxy configuration
- [ ] #6084 — external databases through `WithReference`
- [ ] #7263 — connecting applications to an existing Keycloak instance
- [ ] #14343 — reverse-proxy subpaths and health checks

### Resource modeling and desired configuration

- [ ] #5092 — first-class realm resource and realm endpoint modeling
- [ ] #19693 — desired-state configuration using `keycloak-config-cli`
- [ ] #19692 — Microsoft Entra ID as a Keycloak identity provider

### Samples and product polish

- [ ] microsoft/aspire-samples#416 — representative Keycloak authentication samples
- [ ] #4856 — official Keycloak icon/logo

## Completed baseline

- [x] #4289 — initial `Aspire.Hosting.Keycloak` and `Aspire.Keycloak.Authentication` integrations
- [x] #3201 — initial playground coverage
- [x] #5086 — support importing individual realm files as well as directories
- [x] #6113 — Keycloak health checks
- [x] #6890 — HTTPS development certificate support for non-project resources
- [x] #13807 — deterministic HTTPS endpoint configuration
- [x] #16979 / #17058 — stable HTTPS primary endpoint and token issuer
- [x] OpenTelemetry export is enabled by default by the hosting integration

## Consolidated issues

- #8034 is covered by #6084. The Azure PostgreSQL reference-expression prerequisites shipped in #11051; the remaining Keycloak work is the first-class database reference experience.
- #8064 is covered by #6004, including direct HTTPS, custom certificates, and TLS termination behind a reverse proxy.

## Related platform work

These issues may affect individual scenarios but are broader than the Keycloak integration and are not Keycloak sub-issues:

- #18740 — configurable application-scoped OTLP receiver endpoint
- #18097 — deploy-time values produced by running resources

## Original proposal

Original issue text

I propose adding a Keycloak component to our system for managing authentication and login processes. This integration would be incredibly beneficial, particularly for those using Keycloak, as it would:

- Ensure consistency in different environments.
- Aid in replicating production issues for better troubleshooting.
- Enhance testing capabilities for authentication-related functionalities.

The original proposal suggested adding a Keycloak container to the AppHost and referencing it from application projects. That baseline capability shipped in #4289.