Add configuration, OIDC auth wiring and discovery endpoints (M1)

Options, JWT bearer validation, the /meta and .well-known endpoints, and a dev compose
stack with Keycloak. Verified end to end: compose up, migrate, run, both discovery
endpoints return correct payloads, and readiness reports the schema current.

Configuration:
- Strongly-typed options for Server, Oidc, Relay and Sync, all ValidateOnStart. A
  self-hosted server that boots half-configured and fails later per-request is far harder
  to diagnose than one that refuses to start and names the bad setting.
- Cross-field validation the annotations cannot express: relay needs a WebSocketUrl when
  enabled, idle timeout must be under max session duration, item payload cap under batch cap.
- Startup warnings for combinations that are individually valid but dangerous together:
  RequireHttpsMetadata false outside Development, and AllowEmailLinking (which turns any
  token bearing a victim's email into account takeover, hence default false).

Auth:
- JwtBearer with ClockSkew cut to 30s from the 5-minute default; five minutes of slack on a
  credential granting vault ciphertext access is more than any clock needs.
- IncludeErrorDetails off, and a FallbackPolicy so an endpoint without an explicit policy
  still requires a caller rather than silently being public.

Discovery, per ADR 0002:
- /api/v1/meta reports versions, features and push caps.
- /.well-known/dodossh-configuration is the onboarding story: the user types one server URL
  and the client discovers OIDC authority, client id, scopes and relay endpoint.

Two environment problems found by actually running the stack:
- PostgreSQL 18 changed its data mount point. Mounting /var/lib/postgresql/data — correct
  through 17 — makes the image refuse to start; 18+ wants a single mount at
  /var/lib/postgresql with the cluster in a subdirectory.
- Keycloak moved to host port 18080. An unrelated Apache Tomcat on this machine holds
  127.0.0.1:8080, and a loopback-specific bind beats Docker's 0.0.0.0 publish for
  "localhost". It presents as Keycloak 404ing every realm while its own log says the import
  succeeded, which is a genuinely misleading failure.

Also: CA1848 is enforced, not advisory — warnings are errors, so the .editorconfig comment
claiming otherwise was wrong. Startup and health logging now uses [LoggerMessage]. And a
clean rebuild is back to zero warnings; the incremental build had been hiding 40 in test
projects (banned Guid.NewGuid, an obsolete Testcontainers constructor, and two analyzer
families that are genuinely noise under a test host).

Verified: 0 warnings on a clean rebuild, 122 tests pass, format clean.

deploy/docker-compose.dev.yml

@@ -0,0 +1,59 @@
+# Development dependencies only: PostgreSQL and Keycloak.
+#
+# The API itself runs from the IDE or `dotnet run`, so the inner loop stays fast while the
+# schema is still churning. The production stack is deploy/docker-compose.yml.
+#
+#   docker compose -f deploy/docker-compose.dev.yml up -d
+#   dotnet run --project src/DodoSSH.Api
+#
+# Keycloak admin console: http://localhost:18080  (admin / admin)
+# Test user:              alice / alice
+
+name: dodossh-dev
+
+services:
+  postgres:
+    image: postgres:18-alpine
+    container_name: dodossh-dev-postgres
+    environment:
+      POSTGRES_DB: dodossh
+      POSTGRES_USER: dodossh
+      POSTGRES_PASSWORD: dodossh
+      # Deterministic collation, matching the server's InvariantGlobalization.
+      POSTGRES_INITDB_ARGS: "--encoding=UTF8 --locale=C"
+    ports:
+      - "5432:5432"
+    volumes:
+      # PostgreSQL 18+ wants a single mount at /var/lib/postgresql, with the cluster in a
+      # subdirectory. Mounting /var/lib/postgresql/data directly — which was correct for 17
+      # and earlier — makes the image refuse to start, and pg_upgrade --link cannot cross the
+      # mount boundary later.
+      - postgres-data:/var/lib/postgresql
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U dodossh -d dodossh"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
+  keycloak:
+    image: quay.io/keycloak/keycloak:26.4
+    container_name: dodossh-dev-keycloak
+    # start-dev, never in production: it disables HTTPS enforcement and uses an in-memory
+    # database. The realm is imported on every start so this stays disposable.
+    command: ["start-dev", "--import-realm"]
+    environment:
+      KC_BOOTSTRAP_ADMIN_USERNAME: admin
+      KC_BOOTSTRAP_ADMIN_PASSWORD: admin
+      KC_HEALTH_ENABLED: "true"
+    ports:
+      # 18080, not 8080. Port 8080 is heavily contested on developer machines — a stray Tomcat
+      # or WSL relay bound to 127.0.0.1 wins over Docker's 0.0.0.0 publish for "localhost",
+      # which presents as Keycloak returning 404 for every realm and is thoroughly confusing to
+      # debug. Keycloak derives the token issuer from the request host, so the port simply has
+      # to match Oidc:Authority.
+      - "18080:8080"
+    volumes:
+      - ./keycloak:/opt/keycloak/data/import:ro
+
+volumes:
+  postgres-data: