Harden the public Keycloak surface (Cloudflare Access on /admin; do not expose management port)

Keycloak is now public at `https://sso.drc.nz` via Cloudflare Tunnel. The tunnel ingress only routes `8080`, so the `9000` management/metrics port is not exposed externally — but the admin console at `/admin` is reachable to anyone on the internet (protected only by admin credentials).

## Scope
- Put a Cloudflare Access (Zero Trust) policy in front of `/admin` (and `/realms/master/`), so the admin surface requires an identity check at the edge.
- Confirm the tunnel never routes the `9000` management port (health/metrics); keep it loopback/LAN-internal.
- Note: `9000` currently binds on all interfaces on the host — consider binding the management interface to loopback as well.

Operational hardening only; no code change in this repo.