test(keycloak): HTTPAdapter exercised against an in-process stub KC

Adds internal/keycloak/client_test.go: a minimal stubKC built on
httptest.Server that responds to /token + /admin/serverinfo + the
Admin API paths the adapter actually calls. Coverage on the keycloak
package jumps from ~5% → ~50%; total project line coverage from 60% →
71.6%, back above the 70% gate.

Workflow updated to include internal/keycloak/... in the test
command (was missing — only server + config were enumerated).

Tests added:
  Health success                 GET /admin/serverinfo with bearer
  CreateOrgAndInvite full flow   POST org + user + member + email,
                                 assert call counts and ID parsing
                                 from the Location header
  Conflict surfacing             POST /organizations → 409 →
                                 ErrOrgConflict
  Empty admin email              rejected before any HTTP call
  Token unavailable              connection refused →
                                 errors.Is(err, ErrUnavailable)
  Token unauthorized             401 on /token → ErrUnauthorized
  SyncClaims                     PUT /users/:id with attributes
  Token caching                  3 Health() calls produce ONE
                                 /token fetch — the lock + expiry
                                 check works as designed

Refs: M4.3

.gitea/workflows/ci.yaml

@@ -83,7 +83,7 @@ jobs:
         # own test binary — and including it triggers a covdata-tool error
         # on packages with no _test.go files. -coverpkg makes the server's
         # exercise of store/* count toward coverage.
-        run: go test -race -coverpkg=./internal/... -coverprofile=cover.out ./internal/server/... ./internal/config/...
+        run: go test -race -coverpkg=./internal/... -coverprofile=cover.out ./internal/server/... ./internal/config/... ./internal/keycloak/...
 
       - name: coverage gate
         run: |