- Add JWT bearer auth, session endpoint, and auth audit capture
- Add server-side Keycloak token exchange and refresh endpoints
- Load Keycloak client secret from ignored .env file
- Configure Canopy Keycloak realm, CORS, and Vite API proxy
- Add frontend protected auth callback, token storage, and refresh handling
- Cover backend and frontend auth behavior with tests