Override Keycloak admin client secret in Helm and deployment pipeline

[oveldman]

Summary

Adds KeyCloak__AuthServerUrl and KeyCloak__AdminClientSecret as configurable environment variables on the API Helm deployment. AuthServerUrl is always derived from the ingress domain; AdminClientSecret is exposed as a Helm value and wired through the production values file, the GitHub Actions deployment pipeline, and the docs.

Also updates the Authentication Server guide to add the view-users role assignment and remove the now-outdated manual production secret instructions (superseded by the pipeline secret).

Changes

• deployments/helm/byakko/templates/api.yaml — added KeyCloak__AuthServerUrl (derived from ingress domain) and KeyCloak__AdminClientSecret env vars to the API deployment
• deployments/helm/byakko/Values.yaml — added api.keycloak.adminClientSecret default value
• deployments/helm/byakko/Values.Production.yaml — added api.keycloak.adminClientSecret override
• .github/workflows/deploy-production.yml — added KEYCLOAK_ADMIN_CLIENT_SECRET secret to dry-run and deployment steps
• docs/developer-guides/Pipelines.md — added KEYCLOAK_ADMIN_CLIENT_SECRET to the environment secrets table
• docs/developer-guides/AuthenticationServer.md — added view-users to the required Keycloak roles; removed outdated manual production secret instructions

How to Test

• Run the dry-run pipeline on a PR and confirm helm template succeeds with the new --set api.keycloak.adminClientSecret flag
• Add KEYCLOAK_ADMIN_CLIENT_SECRET under Settings → Environments → vps-production in GitHub and deploy; verify the API pod has the KeyCloak__AdminClientSecret env
  var set correctly
• Confirm the API can obtain a Keycloak token and delete a user account end-to-end

Checklist

• Code builds without errors
• Changes have been tested locally
• No new warnings introduced

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud