feat(keycloak): techgarden login + email theme on dev (WS-05)

[TechGardenCode]

Infra half of cross-repo workstream WS-05. App half: TechGardenCode/techgarden#181 (feature/ws-05-keycloak-login-theme), brief at docs/cross-repo/ws-05-keycloak-login-theme.md.

Dev only. Prod has no techgarden realm; WS-02 derives the prod seed from this.

Route taken: ConfigMap (as briefed), with one contract delta

Delta — two ConfigMaps, not one. The brief specified a single ConfigMap with 18 items[]. That isn't expressible: configMapGenerator keys off the file's base name and ConfigMap keys can't contain /, and the tree has two basename collisions — theme.properties (in both login/ and email/) and messages_en.properties (in both login/messages/ and email/messages/). Splitting per theme type removes the collision without key renaming, and drops items[] to 11 + 6 = 17. The 18th file is README.md — docs, lives beside the theme, not mounted.

Zero theme bytes changed. All 18 files verified byte-identical to TechGardenCode/techgarden@79b6b81 by git blob SHA.

Theme location

kubernetes/clusters/1276-dev/keycloak/keycloak/base/themes/
├── README.md
└── techgarden/{login,email}/…

The three confirmations

1. spec.unsupported.podTemplate — accepted. Confirmed present in the vendored base/operator/crd-keycloaks.yaml @26.6.3, and confirmed as the only volume route. Tech Preview is tolerable here because the operator is version-pinned and vendored in-repo, so merge semantics can't shift under an unplanned upgrade. The custom-image fallback is rejected for the brief's reasons plus one it didn't have: homelab image tags are bot-managed via ci/app-registry.yaml and a PreToolUse hook blocks hand edits, so a hand-built Keycloak image needs a publish path that doesn't exist.
2. ConfigMap mechanics — fine, measured not estimated. login CM serializes to 336,182 B (32.1% of the 1 MiB cap), email to 12,932 B. binaryData auto-selected for the 4 woff2 + .ico + .png; the 2 OFL licences and login.css stayed UTF-8 in data.
3. Pod roll — acknowledged and wired. generatorOptions.disableNameSuffixHash: true is global in this kustomization (config-cli mounts the realm CM by fixed name), so theme CMs get stable names and a theme edit alone won't roll the pod. And Keycloak caches themes 30 days in production mode, so a roll is required regardless of naming. Added techgarden.gg/theme-revision on the podTemplate: bump it on any change under base/themes/ and ArgoCD delivers the roll — no out-of-band kubectl. This PR's own rollout is forced by the volume change itself.

Action-token lifespan

The brief pointed at the wrong field. actionTokenGeneratedByAdminLifespan was already 259200 (72h), so admin-issued execute-actions-email invites were never the 5-minute ones. The 5 minutes observed app-side is actionTokenGeneratedByUserLifespan (Keycloak default 300s), which drives self-service verify-email and forgot-password.

Settled on: pin the base at 300, override verify-email only to 43200 (12h) via realm attributes. A friend's verify link survives the wait; the credential-reset window doesn't widen 144×. Live realm attributes was {}, so the addition is purely additive.

smtpServer / WS-04 Resend transport untouched.

Validation

• kustomize build kubernetes/clusters/1276-dev/keycloak/keycloak — pass
• kubectl apply --server-side --dry-run=server against the live dev CRD — pass (CR + both ConfigMaps)
• python3 -m json.tool on the realm seed — valid
• Mount target verified in the running pod: /opt/keycloak/themes/ contains only README.md, so the mount shadows nothing and parent=base keeps resolving
• Generated output asserted: container keycloak, 2 mounts, 11 + 6 items[], binaryData on the 6 binaries
• Confirmed deep dirs don't spawn stray Applications — base/realms/ and base/operator/ already exist and generate none

Post-merge: config-cli PostSync applies the realm fields, and the podTemplate change rolls keycloak-0.

🤖 Generated with Claude Code

https://claude.ai/code/session_01S5ph2xAnD7oCR8YmFmobDn