feat(keycloak): forte-cli device-code client + forte-drop-mcp audience mapper (#44)

Adds the shared public forte-cli client (RFC 8628 device-code only) to the forte realm, with an oidc-audience-mapper that puts https://mcp.drop.forteapps.net/mcp into aud so the forte-drop-mcp sidecar accepts its tokens. Supersedes #26.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

infra/values/base/keycloak-values.yaml

@@ -186,6 +186,35 @@ keycloakConfigCli:
                 }
               }
             ]
+          },
+          {
+            "clientId": "forte-cli",
+            "name": "Forte CLI",
+            "description": "Shared public client for RFC 8628 device-code login from downloaded skills/CLI tools (forte-drop first) against services behind Auth Sidecar. No client secret.",
+            "enabled": true,
+            "protocol": "openid-connect",
+            "standardFlowEnabled": false,
+            "directAccessGrantsEnabled": false,
+            "publicClient": true,
+            "redirectUris": [],
+            "webOrigins": [],
+            "attributes": {
+              "oauth2.device.authorization.grant.enabled": "true"
+            },
+            "protocolMappers": [
+              {
+                "name": "audience-forte-drop-mcp",
+                "protocol": "openid-connect",
+                "protocolMapper": "oidc-audience-mapper",
+                "consentRequired": false,
+                "config": {
+                  "included.custom.audience": "https://mcp.drop.forteapps.net/mcp",
+                  "access.token.claim": "true",
+                  "id.token.claim": "false",
+                  "introspection.token.claim": "true"
+                }
+              }
+            ]
           }
         ],
         "browserFlow": "browser-auto-idp",
@@ -671,7 +700,7 @@ extraDeploy:
                 MIN_AGE_SEC=$((MIN_AGE_DAYS * 86400))
 
                 # Hardcoded protected clients (never delete these)
-                PROTECTED_JSON='["gitea","grafana","argocd","vaultwarden","account","account-console","admin-cli","broker","realm-management","security-admin-console"]'
+                PROTECTED_JSON='["gitea","grafana","argocd","forte-cli","vaultwarden","account","account-console","admin-cli","broker","realm-management","security-admin-console"]'
 
                 echo "Fetching clients from realm '${REALM}'..."
                 CLIENTS=$(curl -sf -H "Authorization: Bearer ${TOKEN}" \