fix(dev-k8s): resolve Dockerfile.dev from smartem-decisions, refresh devops skill

dev-k8s.sh `ensure_local_image` invoked `docker build -f Dockerfile.dev` from
$PROJECT_ROOT (smartem-devtools), but Dockerfile.dev lives in smartem-decisions.
The build failed with "no such file or directory" on every fresh `up`, leaving
operators to discover the workaround themselves.

Introduce SMARTEM_DECISIONS_PATH, defaulting to a sibling checkout next to
smartem-devtools. Fail fast with a clear message when the file is missing so
non-standard layouts can be configured rather than silently broken.

Refresh the devops skill in the same change: the script path moved to
smartem-devtools, the dev stack now ships an in-cluster Keycloak (with the
docker-compose mock kept as the FE-only fallback), and the build command in
the skill's container section matches what dev-k8s.sh expects.

Author: vredchenko

claude-code/shared/skills/devops/SKILL.md

@@ -39,10 +39,12 @@ If you encounter this error, advise the user to run the above command. Other per
 
 **Cluster management:**
 
+The `dev-k8s.sh` orchestration script lives in **smartem-devtools** (it used to live in smartem-decisions). It needs a sibling checkout of `smartem-decisions` to build the backend image from `Dockerfile.dev`; override `SMARTEM_DECISIONS_PATH` if your layout differs.
+
 ```bash
-cd repos/DiamondLightSource/smartem-decisions
+cd repos/DiamondLightSource/smartem-devtools
 
-# Start local k3s cluster with all services
+# Start local k3s cluster with all services (backend, postgres, rabbitmq, mongo, es, keycloak mock, FE)
 ./scripts/k8s/dev-k8s.sh up
 
 # Stop and cleanup
@@ -53,6 +55,12 @@ kubectl get pods -n smartem-decisions
 kubectl get services -n smartem-decisions
 ```
 
+**Keycloak in the dev stack:**
+
+The in-cluster Keycloak mock (`keycloak-mock/keycloak.yaml`, pulled in via the development kustomization) is the primary local auth provider. It is brought up automatically by `dev-k8s.sh up` and reachable at `http://localhost:30090`.
+
+The `keycloak-mock/docker-compose.yml` in the same directory is a **fallback for FE-only development** — use it when working inside `smartem-frontend` in isolation without the rest of the k3s stack. Do not run both at once or the NodePort/host-port mapping will collide.
+
 ### Services (smartem-decisions namespace)
 
 | Service | Port | NodePort | Purpose |
@@ -77,7 +85,10 @@ k8s/
 ```bash
 cd repos/DiamondLightSource/smartem-decisions
 
-# Build backend image
+# Build local dev backend image (matches what dev-k8s.sh expects)
+docker build -f Dockerfile.dev -t smartem-decisions:latest .
+
+# Build production image
 docker build -t smartem-backend:dev .
 
 # Build with specific Python version (from Dockerfile)
@@ -87,6 +98,8 @@ docker build --build-arg PYTHON_VERSION=3.12 -t smartem-backend:dev .
 docker build --target production -t smartem-backend:prod .
 ```
 
+`dev-k8s.sh up` will build `smartem-decisions:latest` automatically if it is missing, loading it into k3s containerd. Pre-build it manually only if you want to iterate without re-running `up`.
+
 ### Push to Registry
 
 ```bash

scripts/k8s/dev-k8s.sh

@@ -6,6 +6,9 @@ NAMESPACE="smartem-decisions"
 K8S_ENV_PATH="k8s/environments/development"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+# smartem-decisions repo holds Dockerfile.dev for the local backend image build.
+# Override SMARTEM_DECISIONS_PATH if your checkout layout is not the conventional sibling.
+SMARTEM_DECISIONS_PATH="${SMARTEM_DECISIONS_PATH:-$PROJECT_ROOT/../smartem-decisions}"
 DEPLOY_ENV="${DEPLOY_ENV:-development}"
 
 # Colors for output
@@ -380,9 +383,16 @@ ensure_local_image() {
 
     # Check if image exists in Docker
     if ! docker image inspect "$image_name" &> /dev/null; then
-        log_info "Building SmartEM image..."
-        cd "$PROJECT_ROOT"
+        if [[ ! -f "$SMARTEM_DECISIONS_PATH/Dockerfile.dev" ]]; then
+            log_error "Dockerfile.dev not found at: $SMARTEM_DECISIONS_PATH/Dockerfile.dev"
+            log_error "Set SMARTEM_DECISIONS_PATH to the smartem-decisions repo checkout, or"
+            log_error "clone it as a sibling of smartem-devtools."
+            exit 1
+        fi
+        log_info "Building SmartEM image from $SMARTEM_DECISIONS_PATH..."
+        cd "$SMARTEM_DECISIONS_PATH"
         docker build -f Dockerfile.dev -t "$image_name" .
+        cd "$PROJECT_ROOT"
     else
         log_info "SmartEM image already exists in Docker"
     fi