Manage the CCCHH browser authentication flow as YAML

Adds a keycloak_auth_flow role that locally validates flow
definitions (structure, nesting depth, known provider IDs, and a set
of Keycloak authentication-flow gotchas: conditions silently ignored
outside a Conditional subflow, keycloak/keycloak#29515's OTP+WebAuthn
sibling bug, conditional-credential config shape/semantics, and more)
before deploying them idempotently via
middleware_automation.keycloak.keycloak_authentication_v2.

Includes the CCCHH realm's actual "browser passkey and token" flow
(the realm's real browserFlow binding, not the untouched built-in
"browser" flow), exported from the live server so it's now reviewable
and redeployable from this repo instead of only editable in the
Keycloak admin console.

playbooks/deploy.yaml

@@ -110,6 +110,13 @@
   tags:
     - docker_compose
 
+- name: Ensure Keycloak authentication flows are configured
+  hosts: keycloak_auth_flow_hosts
+  roles:
+    - keycloak_auth_flow
+  tags:
+    - keycloak_auth_flow
+
 - name: Ensure NGINX deployment on nginx_hosts
   hosts: nginx_hosts:!public_reverse_proxy_hosts
   roles: