Manage the CCCHH browser authentication flow as YAML

Adds a keycloak_auth_flow role that locally validates flow
definitions (structure, nesting depth, known provider IDs, and a set
of Keycloak authentication-flow gotchas: conditions silently ignored
outside a Conditional subflow, keycloak/keycloak#29515's OTP+WebAuthn
sibling bug, conditional-credential config shape/semantics, and more)
before deploying them idempotently via
middleware_automation.keycloak.keycloak_authentication_v2.

Includes the CCCHH realm's actual "browser passkey and token" flow
(the realm's real browserFlow binding, not the untouched built-in
"browser" flow), exported from the live server so it's now reviewable
and redeployable from this repo instead of only editable in the
Keycloak admin console.

roles/keycloak_auth_flow/tasks/main.yaml

@@ -0,0 +1,25 @@
+- name: Validate Keycloak authentication flow definitions
+  keycloak_auth_flow_lint:
+    realm: "{{ item.realm }}"
+    alias: "{{ item.alias }}"
+    providerId: "{{ item.providerId | default('basic-flow') }}"
+    authenticationExecutions: "{{ item.authenticationExecutions }}"
+  loop: "{{ keycloak_auth_flow__flows }}"
+  loop_control:
+    label: "{{ item.realm }}/{{ item.alias }}"
+
+- name: Deploy Keycloak authentication flows
+  middleware_automation.keycloak.keycloak_authentication_v2:
+    auth_keycloak_url: "{{ keycloak_auth_flow__admin_url }}"
+    auth_realm: master
+    auth_username: "{{ keycloak_auth_flow__admin_username }}"
+    auth_password: "{{ keycloak_auth_flow__admin_password }}"
+    realm: "{{ item.realm }}"
+    alias: "{{ item.alias }}"
+    description: "{{ item.description | default(omit) }}"
+    providerId: "{{ item.providerId | default('basic-flow') }}"
+    authenticationExecutions: "{{ item.authenticationExecutions }}"
+    state: present
+  loop: "{{ keycloak_auth_flow__flows }}"
+  loop_control:
+    label: "{{ item.realm }}/{{ item.alias }}"