Add forte-cli public device-code Keycloak client

Add a shared public client `forte-cli` to the `forte` realm so downloaded
skills (forte-drop first) can do RFC 8628 device-code login through the
Auth Sidecar. Today no client in the realm has the device grant enabled,
so the flow cannot start.

Client (inline in forte-realm.json, imported verbatim by keycloak-config-cli):
- publicClient: true, standardFlowEnabled: false,
  directAccessGrantsEnabled: false
- attributes: oauth2.device.authorization.grant.enabled=true
- no secret, no redirectUris/webOrigins, no k8s.secret.sync

It has to go in the realm JSON because the self-service registrar
hardcodes publicClient:false/standardFlowEnabled:true and drops
attributes. Also add forte-cli to the cleanup CronJob's protected list
(belt-and-braces; it does not match the UUID pattern anyway).

Additive only: gitea/grafana/argocd and all other realm settings are
unchanged. Keycloak is deployed only via the upc-dev overlay, which
inherits base values, so this lands on id.forteapps.net.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QciXev3MtCxo3eomcfrDRW

infra/values/base/keycloak-values.yaml

@@ -200,21 +200,7 @@ keycloakConfigCli:
             "webOrigins": [],
             "attributes": {
               "oauth2.device.authorization.grant.enabled": "true"
-            },
-            "protocolMappers": [
-              {
-                "name": "audience-forte-drop-mcp",
-                "protocol": "openid-connect",
-                "protocolMapper": "oidc-audience-mapper",
-                "consentRequired": false,
-                "config": {
-                  "included.custom.audience": "https://mcp.drop.forteapps.net/mcp",
-                  "access.token.claim": "true",
-                  "id.token.claim": "false",
-                  "introspection.token.claim": "true"
-                }
-              }
-            ]
+            }
           }
         ],
         "browserFlow": "browser-auto-idp",