docs(authenticator): record the broker-era reuse map (EPIC #2193 Phase 5)

[cyberantonz]

Closes the EPIC #2193 Phase 5 task ("Amend ADR-0003 with PoC findings; update the DESIGN reuse map").

• The ADR-0003 half landed earlier: docs(authenticator): record Phase-0 broker PoC results in ADR-0003 Confirmation #2203 recorded the PoC findings in the Confirmation section (go verdict, refresh passthrough, logout propagation with the generic-oidc-provider back-channel gap), and the status history carries the subsequent amendments (in-stack subchart, per-registration tenant pin, fakeidp retirement).
• This PR does the remaining half: the DESIGN §3.10 reuse-map bullet now records what the broker adoption actually reused — Keycloak subchart + keycloak-config-cli as adopted externals (config-as-code only), the seed package's insight-seed-realm generator shared unchanged by compose/local/CI/e2e (the single token contract that made deleting fakeidp possible, feat(auth): retire fakeidp — Keycloak is the IdP everywhere #2315), and the host-keyed issuer map (issuers.rs) as the only authenticator code the broker required.

cfs validate / toc / check-language: clean.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Documentation
  • Updated authenticator design documentation with clearer guidance on Keycloak broker adoption.
  • Documented configuration-as-code setup and shared realm generation across environments.
  • Clarified the supported broker-specific integration and the removal of the legacy test identity provider.

[coderabbitai]

📝 Walkthrough

Walkthrough

The authenticator design document now records Keycloak broker adoption, shared realm configuration, fakeidp removal, and host-based issuer selection.

Changes

Authenticator broker documentation

Layer / File(s)	Summary
Update authenticator reuse map docs/components/backend/authenticator/DESIGN.md	The reuse map documents Keycloak configuration through insight-keycloak and keycloak-config-cli, shared roster-realm generation, fakeidp removal, and host-keyed issuer selection in issuers.rs.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related issues

• Broker Phase 4: migrate environments behind the broker; retire fakeidp #2198 — The documentation records the Keycloak broker migration and fakeidp retirement described by this issue.
• EPIC: Keycloak identity broker rollout (ADR-0003) #2193 — The documentation records the Keycloak broker rollout and host-keyed issuer map described by this issue.

Possibly related PRs

• constructorfabric/insight#1662 — Introduced related authenticator documentation.
• constructorfabric/insight#2170 — Implemented Keycloak broker integration documented by this change.
• constructorfabric/insight#2315 — Implemented Keycloak adoption and fakeidp retirement documented here.

Suggested reviewers: ktursunov

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the documentation update and the broker-era reuse map covered by the pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/components/backend/authenticator/DESIGN.md`:
- Line 969: The reuse-map description uses the ambiguous “roster realm” label;
update the related references around the seed package and realm configuration to
use one canonical Keycloak realm/artifact name consistent with the seeded
output, compose issuer, and gitops artifact. Ensure readers can directly map the
seed output to the deployable realm without guessing, while preserving the
existing reuse and configuration details.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 375d1f15-e33d-460c-9413-0ef21046fc85

📥 Commits

Reviewing files that changed from the base of the PR and between c2aef31 and 1a8f80e.

📒 Files selected for processing (1)

• docs/components/backend/authenticator/DESIGN.md