Portal

Keycloak login via OIDC (confidential client, Authorization Code + PKCE).