feat(keycloak): add techgarden admin realm role and pin iris-web scopes

[TechGardenCode]

Adds the first custom role to the dev techgarden realm. TechGarden's API is gaining its first authorization tier, and Keycloak is the role store.

What changed

Three additive edits to kubernetes/clusters/1276-dev/keycloak/keycloak/base/realms/techgarden-realm.json:

1. Define the realm role — a top-level roles block declaring realm role admin. The realm previously had no roles key at all. Shape matches the sibling realms (hausparty-realm.json, accounts-realm.json).
2. Assign it to the owner — "realmRoles": ["admin"] on the kian user. The other users stay deliberately non-admin so they remain useful as non-privileged test personas. keycloak-config-cli matches users by username (only id is ignored on import), so this binds correctly even though user ids are unpinned here.
3. Pin defaultClientScopes on iris-web — ["web-origins", "acr", "roles", "profile", "basic", "email"], copied from the working kian-coffee-web precedent.

Why it enables the feature

The API gates its feedback triage inbox on ROLE_ADMIN, which Spring derives from realm_access.roles in the access token. realm_access.roles only lands in the token if the client has the roles client scope. iris-web previously omitted defaultClientScopes entirely, so it got that scope only via Keycloak's implicit realm defaults — working, but unpinned and invisible.

Pinning it explicitly also closes a latent trap: the accounts and hausparty clients in this same directory use ["basic", "profile", "email"], which omits roles. A future copy-paste of that shape onto iris-web would silently strip realm_access.roles from every token and break admin gating with no config error to point at. The list is now explicit and self-documenting.

Safety

• Dev-only. There is deliberately no prod techgarden realm (1276-prod/.../realms/ holds only accounts, hausparty, kian-coffee), and nothing under 1276-prod is touched.
• Additive only. Realm reconciliation is keycloak-config-cli as an ArgoCD PostSync hook with every IMPORT_MANAGED_* flag set to no-delete — including IMPORT_MANAGED_ROLE — so this cannot prune existing roles, clients, users, or scopes.
• Session settings untouched. The diff does not modify accessTokenLifespan, revokeRefreshToken, refreshTokenMaxReuse, any ssoSession*/offlineSession* value, or rememberMe — those are tuned for iOS PWA session survival. Verified by assertion, not by eye.
• JSON parses clean (python3 -m json.tool); diff is 21 insertions across exactly the three additions, with no reordering or reformatting of untouched lines.

🤖 Generated with Claude Code