Make Keycloak the single source of truth for user identity

[ganeshmurthy]

Replace the app's duplicated user management with Keycloak as the system of record for identity and authorization. The users table is slimmed to keycloak_id (UUID PK from sub claim) + agent_ids only.

Backend:

• Slim User model: remove username, email, role, created_at, updated_at
• Rename users.id to users.keycloak_id with Alembic migration
• Add CurrentUser composite type combining token identity + DB agent_ids
• Add Keycloak Admin REST API client (client credentials grant) for admin user listings
• Remove seed admin mechanism from migrations
• Fix /validate endpoint to work without token validation sidecar
• Add AUTO_ASSIGN_AGENTS_TO_USERS env var to deployment

Frontend:

• Update User type: id -> keycloak_id, remove timestamps
• Remove user creation/editing UI (new-user-card, user-form components)
• Remove edit mode from user-profile, keep agent assignment
• Update all .id references to .keycloak_id
• Add role-aware "no agents" warning in chat UI

Deployment:

• Create app admin user in ai-apps realm during Keycloak setup job with admin role pre-assigned (prompted during make install)
• Store app admin password in Kubernetes Secret via secretKeyRef
• Add Keycloak OIDC secret, setup configmap, and setup job templates
• Assign view-users role to service account in Keycloak setup job
• Set 'user' as default realm role for new registrations
• Add autoAssignAgents flag to Helm values (default: true)
• Display Keycloak Admin Console URL after install
• Update README with application and Keycloak access URLs