Implement Keycloak account deletion via admin client

[oveldman]

Summary

Wires up real Keycloak user deletion when an account is cleaned up. Adds the Infrastructure.KeyCloak project with IAuthenticationRepository, a KeyCloakTokenHandler that handles client-credentials token acquisition, and integration tests that spin up a real Keycloak Testcontainer to verify users are actually removed.

Changes

• Add Infrastructure.KeyCloak project with AuthenticationRepository implementing DeleteUser and FindUser via IKeycloakClient
• Add KeyCloakTokenHandler — DelegatingHandler that fetches and caches a client-credentials token from /realms/master/protocol/openid-connect/token and attaches it as Authorization: Bearer on every admin API request (fixes 401 caused by AddKeycloakAdminHttpClient not wiring the token handler automatically in v3)
• Fix DeleteUser which previously called GetRealmAsync (realm representation never includes users) — replaced with a direct DeleteUserAsync call
• Add Testcontainers.Keycloak to the API integration tests; ApiHooks now starts a Keycloak container, creates the MadWorld realm, and sets up the madworld-admin-api
  service account with manage-users
• Add KeycloakAdminTestClient helper for driving the Keycloak Admin REST API from step definitions
• Extend ManualTriggers.feature with two new steps: create a user in Keycloak before cleanup, assert it is gone after
• Update CLAUDE.md and rules with Keycloak admin client setup notes and the manage-users / MadWorld-realm gotcha

How to Test

• In Keycloak admin UI (master realm): ensure madworld-admin-api client has Service Accounts Enabled and the service account has manage-users from Client Roles → MadWorld-realm (not realm-management)
• Set Parameters:keycloak-admin-client-secret in user secrets for the Aspire project to match the client secret in Keycloak
• Run the account deletion flow: create account → request deletion → confirm deletion → trigger cleanup → verify user gone from Keycloak
• Run integration tests: dotnet test tests/MadWorldEU.Byakko.Controller.Api.IntegrationTests/ — the "Manually trigger account deletion cleanup" scenario now asserts
  the user is deleted from a real Keycloak container

Checklist

• Code builds without errors
• Changes have been tested locally
• No new warnings introduced

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
82.4% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud