feat: initial scaffold from helm-template

- Keycloak Operator v26 deployed to keycloak-system namespace
- Keycloak HA instance (2 replicas, jdbc-ping cluster discovery)
- Dedicated CNPG cluster (local-postgres storage, 2 instances)
- KeycloakRealmImport: home-lab realm with groups and traefik-oidc client
- Traefik IngressRoute: login.olb42.com (CF Access bypass)
- Admin credentials placeholder (seal before first deploy)
- ArgoCD ApplicationSets: login-operator + login

.gitea/workflows/dormant-pr.yaml

@@ -0,0 +1,19 @@
+name: Propose dormant overlay change
+
+on:
+  push:
+    tags:
+      - dormant/**
+
+jobs:
+  propose-dormant-pr:
+    runs-on: ubuntu-latest
+    env:
+      GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Run dormant PR automation
+        run: scripts/automation/propose-dormant-pr.sh