feat: initial scaffold from helm-template

- Keycloak Operator v26 deployed to keycloak-system namespace
- Keycloak HA instance (2 replicas, jdbc-ping cluster discovery)
- Dedicated CNPG cluster (local-postgres storage, 2 instances)
- KeycloakRealmImport: home-lab realm with groups and traefik-oidc client
- Traefik IngressRoute: login.olb42.com (CF Access bypass)
- Admin credentials placeholder (seal before first deploy)
- ArgoCD ApplicationSets: login-operator + login

.gitignore

@@ -0,0 +1,15 @@
+# Local secret files — never commit plain secrets
+*.secret.plain.yaml
+*.plain.yaml
+
+# CI tooling caches
+.ci-schemas/
+.ci-rendered/
+.ci-chart-cache/
+.helm-cache/
+.helm-config/
+.helm-data/
+.kube/
+
+# macOS
+.DS_Store