feat: initial scaffold from helm-template

- Keycloak Operator v26 deployed to keycloak-system namespace
- Keycloak HA instance (2 replicas, jdbc-ping cluster discovery)
- Dedicated CNPG cluster (local-postgres storage, 2 instances)
- KeycloakRealmImport: home-lab realm with groups and traefik-oidc client
- Traefik IngressRoute: login.olb42.com (CF Access bypass)
- Admin credentials placeholder (seal before first deploy)
- ArgoCD ApplicationSets: login-operator + login

manifest/operator/kustomization.yaml

@@ -0,0 +1,17 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+# Keycloak Operator v26 — official Kubernetes manifests.
+# Pin to a specific release tag; bump here when upgrading Keycloak.
+# Full release list: https://github.com/keycloak/keycloak-k8s-resources/releases
+#
+# These resources include:
+#   - keycloaks.k8s.keycloak.org CRD
+#   - keycloakrealmimports.k8s.keycloak.org CRD
+#   - keycloak-operator Deployment + RBAC (deployed to keycloak-system namespace
+#     as defined in the upstream manifest; operator watches all namespaces)
+
+resources:
+  - https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/26.2.5/kubernetes/keycloaks.k8s.keycloak.org-v1.yml
+  - https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/26.2.5/kubernetes/keycloakrealmimports.k8s.keycloak.org-v1.yml
+  - https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/26.2.5/kubernetes/kubernetes.yml