feat(keycloak): new chart for Keycloak (1.0.0+up26.8.0)

Two replicas with cache=ispn, clustered through Keycloak's default jdbc-ping
stack: discovery runs over the PostgreSQL that is there anyway, so no headless
Service and no JGroups wiring. Deployment rather than StatefulSet - Keycloak 26
keeps everything in the database, user sessions included.

The chart's defining property is that it has TWO INIT CONTAINERS and needs
both. db, health-enabled and metrics-enabled are Keycloak BUILD options
(verified in the 26.8.0 option table), the published image is augmented with
their defaults, and supplying different ones at runtime makes Keycloak rewrite
/opt/keycloak/lib/quarkus at start - which readOnlyRootFilesystem: true forbids
and which upstream describes as a start that "creates an image that is
mutable". Not setting db is no way out: the probes alone force it, because
health-enabled is a build option too. An empty emptyDir over that path fails as
well, because QuarkusEntryPoint loads quarkus/quarkus-application.dat before it
dispatches any command, `build` included. So one init container seeds the
directory into a volume, the next runs `kc.sh build` into it, and the serving
container runs `start --optimized` - every container keeping the full hardening
baseline, with no documented deviation to carry.

Build options therefore exist in exactly one place, and the asymmetry is
enforced rather than trusted: the serving container passes no build option at
all, and a build option's variable name in keycloak.env fails the render with a
message naming it.

Hostname handling is the security-relevant part. KC_HOSTNAME is derived from
ingress.domain as a full URL (which upstream requires alongside hostname-admin),
hostname-strict stays at its default true, and proxy-headers is set rather than
optional. The admin hostname is NOT presented as an access control: upstream
states that hostname-admin "does not prevent accessing the Administration REST
API endpoints via the frontend URL specified by the hostname option", so the
chart renders no /admin deny rule and values.yaml, NOTES.txt and the wiki all
say in the same words that restricting that API is reverse-proxy work.

The management port 9000 is a containerPort and a ClusterIP Service for
in-cluster scraping, and is in no Ingress: it serves /health/* and optionally
/metrics without authentication. Liveness uses /health/live and deliberately
not /health or /health/ready - those include the database, and a liveness probe
on them would restart the whole cluster for as long as the database is away.

Also in this change:
- First PodDisruptionBudget in this repository, which makes it a convention
  (README section 11): minAvailable as a value, and rendered only while the
  computed replica count is >= 2, because minAvailable: 1 with one replica
  blocks every node drain forever with a message that names the PDB rather
  than the replica count.
- First quay.io image, so quay.io joins the trusted registries in
  ci/trivy/data/ksv0125.yaml - configured rather than suppressed, so
  AVD-KSV-0125 keeps being able to say something.
- Renovate block with NO version constraint, which is the counter-case to
  garage and stalwart and is measured rather than assumed: docker versioning
  already excludes the -N rebuild tags, the floating minors and latest/nightly.
  Three dry-run fixtures are recorded at the block, and against the committed
  config 26.7.4 offers exactly 26.7.5 (patch) and 26.8.0 (minor).
- No automerge exception, by decision (Gitea #83): the global automerge applies,
  and the minor-upgrade procedure plus `kc.sh update-compatibility` is
  documented in NOTES.txt instead.
- Two upstream defaults deviated from, each with its reason at the value:
  db-pool-max-size 20 instead of 100 (two replicas at 100 ask a default
  PostgreSQL for twice its max_connections), and uid 1000 / gid 0 instead of
  this repo's 20000/1000, because the image declares keycloak:x:1000:0 and
  chowns its install tree to that pair.

Part of #83

renovate.json5

@@ -393,6 +393,51 @@
       datasourceTemplate: "docker",
       depTypeTemplate: "app-version",
     },
+    {
+      description: [
+        "keycloak: the counter-case to garage and stalwart, and the one block in this file whose",
+        "DESIGN DECISION IS AN ABSENCE. quay.io/keycloak/keycloak carries four tag shapes side by",
+        "side (measured 2026-10-04 against the tag API): release tags 26.8.0; REBUILD tags with a",
+        "numeric suffix, 26.8.0-0 / 26.7.3-1 / 26.7.2-2, where the same app version is rebuilt for",
+        "a base-image or CVE fix (26.8.0-0 resolves to the SAME manifest digest as 26.8.0);",
+        "floating minor tags 26.8 / 26.7; and the floating names latest and nightly, the latter",
+        "rebuilt daily.",
+        "",
+        "That is the same genus of trap as garage's commit-SHA tags - and here plain `docker`",
+        "versioning already handles all of it, so this block carries NO versioningTemplate.",
+        "Docker versioning splits a tag at the first dash and only ever offers candidates with the",
+        "SAME suffix as the current value; ours has none, so the -N rebuilds are invisible to it.",
+        "The floating minors fail on the missing third part, and latest/nightly parse as no",
+        "version at all.",
+        "",
+        "MEASURED, NOT ASSUMED, and written down because a later round will otherwise add a",
+        "constraint 'to be safe' - which would be a line that does nothing, and one more thing to",
+        "keep correct. Renovate 44.132.5, --platform=local --dry-run=lookup, real registry:",
+        "  appVersion 26.8.0 -> updates [], warnings []",
+        "  appVersion 26.7.0 -> exactly one: 26.8.0 (updateType minor)",
+        "  appVersion 26.7.4 -> exactly two: 26.7.5 (patch), 26.8.0 (minor)",
+        "No run offered a rebuild tag, a floating minor, latest or nightly. The 26.7.4 fixture is",
+        "the guard the nginx and qbittorrent rules taught us to run: it proves real updates still",
+        "come through rather than the filter quietly emptying the list.",
+        "",
+        "AND WHAT THIS BLOCK DELIBERATELY DOES NOT CARRY: an automerge exception. Keycloak",
+        "supports a rolling update only WITHIN a minor line - a minor jump needs every node shut",
+        "down first - so a packageRules entry switching automerge off for minor and major was",
+        "proposed and DECIDED AGAINST (Gitea #83): the global automerge at the top of this file",
+        "applies here too. That is an accepted risk rather than an oversight, and the consequence",
+        "is documented instead of prevented: keycloak/templates/NOTES.txt and the wiki page carry",
+        "the minor-upgrade procedure (scaleDown, back up, bump, scale up) together with the",
+        "statement that the automerge does not know about it, plus the `kc.sh",
+        "update-compatibility metadata|check` calls whose exit code is meant to drive exactly this",
+        "decision. If a minor PR has merged itself, that procedure is the repair.",
+      ],
+      customType: "regex",
+      managerFilePatterns: ["keycloak/Chart.yaml"],
+      matchStrings: ["(?m)^appVersion:\\s*\"?(?<currentValue>[^\"\\s]+)\"?"],
+      depNameTemplate: "quay.io/keycloak/keycloak",
+      datasourceTemplate: "docker",
+      depTypeTemplate: "app-version",
+    },
     {
       customType: "regex",
       managerFilePatterns: ["matrix-synapse/Chart.yaml"],