- add Keycloak role mapping, app authorization policies, and logout/session coverage
- add shared append-only audit logging with authorization audit events
- add read-only legacy data access anti-corruption layer
- add legacy schema compatibility gate, admin API, and client schema check panel
- update story artifacts, planning docs, sprint status, and test coverage

- Add JWT bearer auth, session endpoint, and auth audit capture
- Add server-side Keycloak token exchange and refresh endpoints
- Load Keycloak client secret from ignored .env file
- Configure Canopy Keycloak realm, CORS, and Vite API proxy
- Add frontend protected auth callback, token storage, and refresh handling
- Cover backend and frontend auth behavior with tests