Point kdive at the Keycloak realm and document the real-OIDC path

Once the `kdive` realm and protocol mappers exist (#349), point the kdive server at Keycloak instead of the mock issuer.

## Scope
- Set the runtime OIDC env (`src/kdive/config/core_settings.py`):
- `KDIVE_OIDC_ISSUER=https://sso.drc.nz/realms/kdive`
- `KDIVE_OIDC_JWKS_URI=https://sso.drc.nz/realms/kdive/protocol/openid-connect/certs`
- `KDIVE_OIDC_AUDIENCE=kdive` (unchanged)
- Document the real-OIDC issuer alongside the existing mock in `docker-compose.yml`, `deploy/helm/kdive/`, and the runbooks. The mock (`ghcr.io/navikt/mock-oauth2-server`) stays for unit/CI; Keycloak is the homelab/real path.
- Verify the server’s OIDC reachability probe (`src/kdive/health/server_checks.py`) passes against the Keycloak JWKS.

Live discovery for reference:
```
issuer: https://sso.drc.nz/realms/master
jwks_uri: https://sso.drc.nz/realms/master/protocol/openid-connect/certs
```
(swap `master` for `kdive` once that realm exists.)

Depends on #349.