Manage the CCCHH browser authentication flow as YAML

Adds a keycloak_auth_flow role that locally validates flow
definitions (structure, nesting depth, known provider IDs, and a set
of Keycloak authentication-flow gotchas: conditions silently ignored
outside a Conditional subflow, keycloak/keycloak#29515's OTP+WebAuthn
sibling bug, conditional-credential config shape/semantics, and more)
before deploying them idempotently via
middleware_automation.keycloak.keycloak_authentication_v2.

Includes the CCCHH realm's actual "browser passkey and token" flow
(the realm's real browserFlow binding, not the untouched built-in
"browser" flow), exported from the live server so it's now reviewable
and redeployable from this repo instead of only editable in the
Keycloak admin console.

inventories/chaosknoten/host_vars/keycloak.yaml

@@ -17,3 +17,7 @@ nginx__configurations:
     content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/keycloak/nginx/keycloak-admin.hamburg.ccc.de.conf') }}"
   - name: invite.hamburg.ccc.de
     content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/keycloak/nginx/invite.hamburg.ccc.de.conf') }}"
+
+keycloak_auth_flow__admin_password: "{{ secret__keycloak_admin_password }}"
+keycloak_auth_flow__flows:
+  - "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/keycloak/auth_flows/browser.yaml') | from_yaml }}"

inventories/chaosknoten/hosts.yaml

@@ -162,6 +162,9 @@ docker_compose_hosts:
 nextcloud_hosts:
   hosts:
     cloud:
+keycloak_auth_flow_hosts:
+  hosts:
+    keycloak:
 nginx_hosts:
   hosts:
     acmedns: