Retire the mock-only kdivectl login (cli/login.py) for real OIDC

The `kdivectl login` flow in `src/kdive/cli/login.py` is specific to the mock issuer and will not work against Keycloak:

- It POSTs a literal `claims` JSON blob to the issuer (`_authorization_code`, lines ~176-178), letting the *client* self-assert `projects`/`roles`/`platform_roles`. A real IdP never lets the client assert its own grants — that is the point of an SSO.
- It assumes the mock’s endpoint paths (`/authorize`, `/token`, `/jwks` directly off the base URL); Keycloak uses `/realms//protocol/openid-connect/{auth,token,certs}`.

The module docstring already notes production operators bring their own token via `KDIVE_TOKEN`.

## Scope (needs design)
- Decide the production token-acquisition path: document `KDIVE_TOKEN` (operator brings a token from the SSO) and/or implement a standard OIDC client (authorization-code or client-credentials grant) against Keycloak.
- Keep the mock-driven `login()` for unit/CI use, or move it behind a test-only seam, so the live-stack harness that imports these symbols still works.

Depends on #349; relates to #350.