feat: initial scaffold from helm-template

- Keycloak Operator v26 deployed to keycloak-system namespace
- Keycloak HA instance (2 replicas, jdbc-ping cluster discovery)
- Dedicated CNPG cluster (local-postgres storage, 2 instances)
- KeycloakRealmImport: home-lab realm with groups and traefik-oidc client
- Traefik IngressRoute: login.olb42.com (CF Access bypass)
- Admin credentials placeholder (seal before first deploy)
- ArgoCD ApplicationSets: login-operator + login

README.md

@@ -0,0 +1,10 @@
+# login
+
+Operator-managed Keycloak HA deployment. Identity and access management for all home-lab services.
+
+- **URL**: https://login.olb42.com
+- **Realm**: `home-lab`
+- **Operator**: [keycloak-operator](https://github.com/keycloak/keycloak-operator) v26
+- **Database**: CNPG PostgreSQL (`local-postgres` storage class)
+
+See [OPERATIONS.md](./OPERATIONS.md) for bootstrap, secret sealing, and client management procedures.