Keycloak: social brokers (Google/MS/Apple) + Steam OIDC bridge (ADR-0028 §4)

[ChrisonSimtian]

Follow-up to #292 (local-dev Keycloak core landed in PR #302). Deferred per ADR-0028 §4 — needs manual external setup, so parked until we pick it up.

Scope

• Google / Microsoft / Apple as Keycloak identity-provider brokers (first-class OIDC, config-only in the realm export).
• Steam via the byo-software/steam-openid-connect-provider .NET bridge container (steam-oidc), brokered by Keycloak as a generic OIDC IdP. Steam speaks legacy OpenID 2.0 which Keycloak dropped.

External prerequisites (manual, one-time — @ChrisonSimtian)

• Register OAuth apps with Google, Microsoft, Apple → client id/secret per provider.
• Obtain a Steam Web API key (Steam__ApplicationKey) + client id/secret + redirect URI for the bridge.

Work

• Add the broker configs to realm-erp.json (or a prod realm overlay).
• Add the steam-oidc bridge container (prod compose stack — rides ADR-0026 Phase 5c5: CoI API flesh-out + operational rollout (3 cnames, 3 containers) #281) + Keycloak generic-OIDC broker pointing at its discovery URL.
• Local dev stays username/password (the bridge is prod/opt-in).

Tracking only — do not start until prioritized.