ci: supply Keycloak config to api-smoke and preflight it

[saqibmanan]

Merge this before the caller PRs, and only after KEYCLOAK_CLIENT_SECRET exists as a repository secret.

The problem

run-smoke.yml passed no Keycloak variables at all. So keycloak_config skipped, every authenticated API test skipped with it, and the run summary still read 0 failed.

A green api-smoke therefore did not mean the authenticated paths worked — it meant they had not been attempted. That is how a stale KEYCLOAK_URL pointing at the decommissioned opub-kc server survived the migration without anything going red.

The change

Host, realm and client id are public, so they become repo variables with literal defaults — correct out of the box, visible in review, overridable without a code change. dataspace is a confidential client (ROPC returns 401 unauthorized_client without a secret), so KEYCLOAK_CLIENT_SECRET is a real secret.

A preflight step now fails the job when any of the four is missing, and checks OIDC discovery before any test runs.

Why the issuer is pinned separately

EXPECTED_ISSUER is declared independently rather than derived from KEYCLOAK_URL.

Deriving it is vacuous. The decommissioned server reports its own /auth issuer perfectly consistently, so comparing an issuer against the host it came from passes for any running Keycloak and proves nothing about which one it is. I wrote that version first and tested it with KEYCLOAK_URL still set to opub-kc — it passed. Same failure class as the bug this is meant to catch.

Why this targets CI, not dev

Callers reference run-smoke.yml@CI, so CI is the only ref that takes effect. CI is also dev +46 lines — the api_base_url / deployed_sha / min_passed inputs exist only here — so the patch is applied directly rather than merged, leaving those inputs untouched.

The same commit also rides along on test/keycloak-migration-and-new-features (against dev) so a later dev → CI merge does not silently revert it. Expect a conflict in that hunk; either side is fine.

Preflight behaviour, all four paths tested

Condition	Result
Secret missing	fails, names the variable
Stale /auth URL	fails on issuer mismatch
Host unreachable	fails, no discovery document
Correct config	passes

Blast radius

KEYCLOAK_CLIENT_SECRET is declared optional in workflow_call so the three existing callers keep parsing. But api-smoke fails its preflight until each caller passes it and the secret is set. DataSpaceFrontend gates promote-dev on smoke passing, so dev promotion will block until then.

Ordering: add the secret everywhere → merge this → merge the two caller PRs.