v0.4.0

Added

• Structured, leveled logging via OPENCODE_KC_LOG
  (silent/error/warn/info/debug, default warn), prefixed with
  [keycloak-auth]. Secrets are never logged.
• ConfigError that names every missing required setting at once.

Changed

• A missing/incomplete configuration now logs a loud warn
  (registered in ERROR mode (missing: …)) instead of failing silently.
• The token loader no longer swallows persistence failures — it warns, since a
  lost rotated token would otherwise strand auth until re-login.
• Login flows (auto-capture, paste-code, device) log the real failure cause
  instead of an opaque failed.
• Test suite expanded from 29 to 99 tests, covering log, errors, keycloak,
  browser, and shared in addition to the existing suites.