fix(prod): persist Keycloak data across container recreate (#564)

* fix(prod): persist Keycloak data across container recreate

The online prod auth overlay ran Keycloak in start-dev with its embedded
H2 store inside the container and no volume, so every recreate wiped all
accounts/credentials created in the admin console, leaving only the
realm-export.json seed. Add a keycloak_data volume on /opt/keycloak/data
so runtime-created users survive, matching docker-compose.offline-prod.yml.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix/scope-keycloak-volume-to-h2-subdir

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: NotYuSheng

docker-compose.prod.yml

@@ -38,6 +38,13 @@ services:
       TZ: Asia/Singapore
     volumes:
       - ./keycloak/realm-export.json:/opt/keycloak/data/import/realm-export.json:ro
+      # Persist Keycloak's embedded H2 store so accounts/credentials created at
+      # runtime in the admin console survive container restart/recreate. Without
+      # this, start-dev keeps its data inside the container and every recreate
+      # wipes all users, forcing a re-import of only the realm-export.json seed.
+      # Scoped to the h2 subdir (not all of /opt/keycloak/data) so the named
+      # volume doesn't nest over the realm-export.json bind mount above.
+      - keycloak_data:/opt/keycloak/data/h2
     networks:
       - tracepcap-network
 
@@ -64,3 +71,7 @@ services:
     depends_on:
       - backend
       - keycloak
+
+volumes:
+  keycloak_data:
+    driver: local