feat: add Keycloak authentication for dashboard and API endpoints (#2)

Dashboard: OAuth2/OIDC login flow with PKCE, session-based auth middleware
protecting all server function endpoints, check-auth server function for
frontend auth state, login page gate in AppShell, user info in sidebar.

Agent API: JWT validation middleware using Keycloak JWKS endpoint,
conditionally enabled when KEYCLOAK_URL and KEYCLOAK_REALM are set.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-authored-by: Sharang Parnerkar <parnerkarsharang@gmail.com>
Reviewed-on: #2

compliance-dashboard/src/infrastructure/user_state.rs

@@ -0,0 +1,18 @@
+use serde::{Deserialize, Serialize};
+
+/// Per-session user data stored in the tower-sessions session store.
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct UserStateInner {
+    pub sub: String,
+    pub access_token: String,
+    pub refresh_token: String,
+    pub user: User,
+}
+
+/// Basic user profile stored alongside the session.
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct User {
+    pub email: String,
+    pub name: String,
+    pub avatar_url: String,
+}