Run M1's end-to-end slice, and fix the two bugs it found

The whole vertical slice now runs against a real Keycloak, a real API, a
real PostgreSQL and a real sshd: sign in through the browser flow, enroll
with the identity-provider key binding, unlock, create a host, sync it,
read it back on a second machine, unlock again with no network, accept an
unseen host key, and open an interactive shell. Opt-in, because it needs
the development stack; skipped with a message naming the commands.

It found two bugs on its first run, and both are the same class: two
sides of a stub agreeing with each other about something the
specification never said.

**The API never applied DodoSshJsonContext to its HTTP JSON options.**
Minimal APIs therefore used the framework's web defaults, which write an
enum as a number. Every request DTO carrying one failed to bind against a
client writing the specified string form — which is the entire sync
surface, unreachable from the real client, with a 400 naming only the
parameter. The documented guarantee that request bodies reject unmapped
members was likewise not in effect anywhere.

Nothing caught it because the API tests posted with PostAsJsonAsync's
defaults, so they and the server had independently settled on integers.
Those tests now serialise through the contract, which is the deeper fix:
removing the new configuration fails 13 of them. Copying settings into
options a host owns is itself the hazard the context warns about, so
ApplyTo lives beside the settings it mirrors and ApplyToTests pins the
transformation, including that inserting the resolver leaves the caller's
own in place.

**The realm registered a loopback redirect URI Keycloak rejects.**
`http://127.0.0.1:*/callback` looks more explicit than the RFC 8252 form
and is broken: Keycloak's wildcards are trailing-only, so the `*` parses
as a literal port and every authorization request came back "Invalid
parameter: redirect_uri". Providers ignore the port for loopback hosts,
which is the whole mechanism, so the correct registration is
`http://127.0.0.1/callback` — path pinned, port free. The value the
server advertises through the discovery document said the same wrong
thing and now says the right one.

Two smaller things, both documented in docs/platform-flags.md:

- --import-realm skips a realm that already exists, so editing the realm
  file and restarting Keycloak changes nothing and serves stale
  configuration. The container has to be recreated. The compose comment
  claimed the opposite.
- Keycloak marks its session cookies Secure even over plain HTTP, because
  SameSite=None requires it. A spec-conformant client drops them and the
  login POST answers 400 with no message; browsers complete the flow only
  because they exempt loopback. Harmless for the product, fatal for
  automation, so ScriptedBrowser carries the cookies by hand and says why.

Also: the server enforces a 64 MiB floor on the passphrase KDF, so this
suite cannot use the 8 MiB profile the other client suites take for
speed. Those only get away with it because their in-memory servers have
no policy — worth knowing rather than rediscovering.

638 tests. The solution-wide run stays green with the stack down: exit
code 8 means "no tests ran", which the platform reports as failure, so
the opt-in project ignores exactly that code.

docs/platform-flags.md

@@ -103,6 +103,40 @@ minimal desktop or inside a Flatpak sandbox — where the portal is the correct
 sign-in silently does nothing on Linux, this is the first thing to check. `IBrowserLauncher` exists
 so a platform-specific opener can be substituted without touching the flow.
 
+## Identity provider
+
+**A loopback redirect URI must be registered without a port, not with a wildcard port.** Keycloak — and
+providers implementing RFC 8252 §7.3 generally — ignores the port when the registered redirect URI's host
+is a loopback literal, which is what lets a native client bind an ephemeral port. Registering
+`http://127.0.0.1:*/callback` looks more explicit and is *broken*: the `*` is parsed as a literal port and
+every real authorization request comes back `400 Invalid parameter: redirect_uri`. Keycloak's wildcard
+support is trailing-only, so a `*` in the middle of a URI never means what it looks like.
+
+Register `http://127.0.0.1/callback`. Keep the path — it is the part that stops another process on the
+machine having an authorization code delivered to a different endpoint. `Oidc:LoopbackRedirectPattern`,
+which the server advertises through `/.well-known/dodossh-configuration`, says the same thing so an
+operator configuring a different provider copies something that works.
+
+Found by running the sign-in against a real Keycloak; every test until then used a stub that accepted
+whatever it was given.
+
+**Keycloak marks its session cookies `Secure` even over plain HTTP**, because `SameSite=None` is only
+legal alongside `Secure`. A spec-conformant HTTP client therefore refuses to store them from an `http://`
+origin — .NET's `CookieContainer` drops every one silently — and the login form POST then comes back
+`400` with no explanation at all. Browsers complete the flow because they treat loopback as a trustworthy
+origin and make the exception.
+
+This does not affect the product: the client uses the system browser, which makes that exception. It does
+affect any non-browser automation against a development Keycloak, which has to carry the cookies by hand
+(see `ScriptedBrowser`) or be given HTTPS. Two hours of "the credentials must be wrong".
+
+**`--import-realm` skips a realm that already exists.** Editing `deploy/keycloak/realm-dodossh.json` and
+running `docker compose restart keycloak` therefore changes nothing, and the stale configuration keeps
+being served — which reads exactly like the edit being wrong. `start-dev` keeps its state in an H2
+database inside the container, so the realm has to be recreated along with it:
+`docker compose rm -sf keycloak && docker compose up -d keycloak`. Cost an otherwise inexplicable
+debugging detour.
+
 ## Local cache
 
 **The cache location is per-OS and must stay non-roaming.** `ClientPaths` chooses it: