Adds a `keycloakUrl` chart value: when set, it replaces host + Keycloak's
NodePort as the pinned issuer and the portals' OIDC authority, so the stack
works behind the existing *.labs.respellion.tech Caddy over HTTPS. Empty keeps
today's behaviour. The deploy workflow passes the KEYCLOAK_URL repo variable.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>