feat: initial scaffold from helm-template

- Keycloak Operator v26 deployed to keycloak-system namespace
- Keycloak HA instance (2 replicas, jdbc-ping cluster discovery)
- Dedicated CNPG cluster (local-postgres storage, 2 instances)
- KeycloakRealmImport: home-lab realm with groups and traefik-oidc client
- Traefik IngressRoute: login.olb42.com (CF Access bypass)
- Admin credentials placeholder (seal before first deploy)
- ArgoCD ApplicationSets: login-operator + login

manifest/overlays/dormant/kustomization.yaml

@@ -0,0 +1,22 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: login
+
+# Dormant mode: CNPG cluster stays alive to preserve data.
+# Keycloak instance is scaled to zero by patching the Keycloak CR.
+resources:
+  - ../../base/state
+
+patches:
+  - patch: |
+      - op: replace
+        path: /spec/instances
+        value: 0
+    target:
+      kind: Keycloak
+      name: keycloak
+
+commonLabels:
+  app.kubernetes.io/part-of: login
+  app.kubernetes.io/environment: dormant