sec: remove plaintext passwords from realm ConfigMap

Use keycloak-config-cli env var substitution $(env:VAR_NAME) to inject
user passwords from K8s Secret instead of hardcoding them in ConfigMap.

- realm-configmap.yaml: passwords replaced with $(env:KC_INFRA_ADMIN_PASSWORD)
  and $(env:KC_INFRA_CLAUDE_PASSWORD)
- keycloak ArgoCD app: added keycloakConfigCli.extraEnvVarsSecret
- Secrets sourced from OpenBao via create-keycloak-secrets.sh

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/keycloak/realm-configmap.yaml

@@ -51,7 +51,7 @@ data:
           "enabled": true,
           "firstName": "Admin",
           "groups": ["infra-admins"],
-          "credentials": [{"type": "password", "value": "Kc@Adm1nInfra2026!", "temporary": false}],
+          "credentials": [{"type": "password", "value": "$(env:KC_INFRA_ADMIN_PASSWORD)", "temporary": false}],
           "requiredActions": []
         },
         {
@@ -60,7 +60,7 @@ data:
           "enabled": true,
           "firstName": "Claude",
           "groups": ["infra-bots"],
-          "credentials": [{"type": "password", "value": "Kc@Cl4udeBot2026!", "temporary": false}],
+          "credentials": [{"type": "password", "value": "$(env:KC_INFRA_CLAUDE_PASSWORD)", "temporary": false}],
           "requiredActions": []
         }
       ],

argocd-apps/keycloak.yaml

@@ -45,6 +45,7 @@ spec:
             registry: docker.io
             repository: bitnamilegacy/keycloak-config-cli
             tag: 6.4.0-debian-12-r11
+          extraEnvVarsSecret: keycloak-configcli-secrets
         postgresql:
           enabled: true
           image: