Introduces the Municipalities namespace with domain entity, in-memory
repository, and REST API. Extends the workspace shell with a live panel.

Backend:
- MunicipalityProfile record (ILegacyLinkedRecord) — participates in
  Story 1.8 nightly link integrity check automatically
- InMemoryMunicipalityProfileRepository — validates JCode before save
  (AC #4), resolves legacy jurisdiction for combined views (AC #2)
- POST/GET/PUT /api/municipalities/profiles — ClientServicesAccess policy;
  audit-logged creates and updates (AC #3)

Frontend:
- municipalityContracts.ts — typed fetch helpers, MunicipalityValidationError
- MunicipalityProfilePanel — table with combined legacy+extension data,
  modal create form with JCode validation error display
- WorkspaceShell — municipalities nav now renders the panel

Tests: 16 backend + 9 frontend (133 server / 36 client total, 0 failures)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- wire legacy schema checks to live OleDb inspection and durable history
- harden schema baseline parsing and add constraint drift detection
- authenticate admin schema API calls from the client
- add release-gate workflow for legacy schema validation
- add extension-record save path with pre-save legacy link validation
- add link ambiguity detection, provider coverage reporting, and nightly integrity scheduler
- mark stories 1.7 and 1.8 done after review fixes

- add Keycloak role mapping, app authorization policies, and logout/session coverage
- add shared append-only audit logging with authorization audit events
- add read-only legacy data access anti-corruption layer
- add legacy schema compatibility gate, admin API, and client schema check panel
- update story artifacts, planning docs, sprint status, and test coverage

- Add JWT bearer auth, session endpoint, and auth audit capture
- Add server-side Keycloak token exchange and refresh endpoints
- Load Keycloak client secret from ignored .env file
- Configure Canopy Keycloak realm, CORS, and Vite API proxy
- Add frontend protected auth callback, token storage, and refresh handling
- Cover backend and frontend auth behavior with tests