Add infra/keycloak/docker-compose.yml (Keycloak 26.1, dev mode, --import-realm)
with four realms imported at boot (infra/keycloak/realms/*.json): digid,
eherkenning, eidas, medewerker. Each has a public big-portal OIDC client
(standard flow + direct access grants) and test users; protocol mappers inject
the identifying claims (bsn / kvk / eidas_id) and medewerker realm roles.
Add `make keycloak-up/keycloak-smoke/keycloak-down`; keycloak-smoke runs
infra/keycloak/check_realms.py (password-grant login per realm, asserts the
claim). Document credentials in docs/synthetic-data.md and a runbook.
Verified: `make keycloak-smoke` green — all four realms log in and return the
expected claims (bsn 123456782, kvk 12345678, eidas_id FR/NL..., role behandelaar).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add tools/seed-gitea.sh, which bootstraps the Gitea repo from BACKLOG.md:
the label taxonomy, the seven iteration milestones, and all 26 slice
issues (S-00..S-25). Driven by curl/jq against the Gitea API; reads
GITEA_TOKEN from the environment. Idempotent — every item is matched
before creation, so a partial or failed run can be re-run safely.
Document it in tools/README.md (prerequisites, usage, what it creates,
verification). Overlaps part of S-00's "labels/milestones exist in
Gitea" acceptance; the authoritative runbook moves to docs/ under S-00.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
