feat(keycloak): add tenant-context client scope + M7.1 test users

Adds the breakpilot platform multi-tenancy claims to the dev realm
so M7.x products (starting with compliance-scanner-agent) can
authenticate against the local CERTifAI stack end-to-end.

New tenant-context client scope, included by default on all three
clients, with six protocol mappers backed by user attributes:

  tenant_id, tenant_slug, tenant_status, plan (strings)
  org_roles, products (multi-valued)

Five test users cover every tenant_status branch:

  admin@certifai.local  (acme, active, IT_ADMIN + CXO)
  user@certifai.local   (acme, active, USER)
  trial@acme.local      (trialco, trial)
  frozen@acme.local     (frozenco, frozen)   -> 402 on writes
  archived@acme.local   (archiveco, archived) -> 410 always

Enables Direct Access Grants on certifai-dashboard so password-
grant requests work for local API testing. This is the dev realm
only (KC_DB: dev-mem); prod realms inherit nothing from this file.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -9,13 +9,6 @@ on:
       - main
 
 env:
-  # registry + cosign creds via env, NOT inline ${{ }}: the Harbor robot
-  # username contains '$', which sh expands when interpolated into the
-  # script (robot$ci-push -> robot-push) => docker login unauthorized.
-  REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
-  REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
-  COSIGN_KEY: ${{ secrets.COSIGN_KEY }}
-  COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
   CARGO_TERM_COLOR: always
   RUSTFLAGS: "-D warnings"
   # sccache caches compilation artifacts within a job so that compiling
@@ -280,14 +273,11 @@ jobs:
           git checkout FETCH_HEAD
       - name: Build and push image
         run: |
-          IMAGE=repo.breakpilot.com/certifai/certifai-dashboard
+          IMAGE=registry.meghsakha.com/certifai-dashboard
-          echo "$REGISTRY_PASSWORD" | \
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | \
-            docker login repo.breakpilot.com -u "$REGISTRY_USERNAME" --password-stdin
+            docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
           docker build -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
           docker push "$IMAGE:latest"
-          { command -v cosign >/dev/null 2>&1 || curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 || wget -qO /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64; } || echo "::warning::cosign fetch failed"
-          chmod +x /usr/local/bin/cosign 2>/dev/null || true
-          cosign sign --yes --key env://COSIGN_KEY "$IMAGE:latest" || echo "::warning::cosign failed"
           docker push "$IMAGE:${GITHUB_SHA}"
       - name: Trigger orca redeploy
         run: |

docker-compose.yml

@@ -5,11 +5,7 @@ services:
     environment:
       KC_BOOTSTRAP_ADMIN_USERNAME: admin
       KC_BOOTSTRAP_ADMIN_PASSWORD: admin
-      # dev-file persists Keycloak's H2 DB under /opt/keycloak/data/h2/
+      KC_DB: dev-mem
-      # so the realm + test users survive container restarts. With the
-      # previous dev-mem the realm dissolved every time KC went idle,
-      # breaking local M7.1 smoke testing.
-      KC_DB: dev-file
       KC_HEALTH_ENABLED: "true"
     ports:
       - "8080:8080"
@@ -19,7 +15,6 @@ services:
     volumes:
       - ./keycloak/realm-export.json:/opt/keycloak/data/import/realm-export.json:ro
       - ./keycloak/themes/certifai:/opt/keycloak/themes/certifai:ro
-      - keycloak-data:/opt/keycloak/data/h2
     healthcheck:
       test: ["CMD-SHELL", "exec 3<>/dev/tcp/localhost/8080 && echo -e 'GET /realms/master HTTP/1.1\\r\\nHost: localhost\\r\\nConnection: close\\r\\n\\r\\n' >&3 && head -1 <&3 | grep -q '200 OK'"]
       interval: 10s
@@ -261,4 +256,3 @@ volumes:
   langfuse-db-data:
   langfuse-clickhouse-data:
   langfuse-clickhouse-logs:
-  keycloak-data: