[fix] provision_operator: derive identity + endpoints generically (ADR 0407)

[baditaflorin]

Summary

scripts/provision_operator.py (ADR 0318 — the one-shot operator onboarding
tool that creates a Keycloak user, mints a Headscale VPN key, and emails the
new operator their SSO credentials + service list + SSH/VPN tutorial) still
carried pre-migration generic constants and never adopted the ADR-0385/0407
identity-derivation pattern. Against the live deployment it targeted a
non-existent Keycloak realm (lv3, now 404) and unreachable *.localhost
hosts, and emailed a stale service list.

This makes it work as one command on any deployment without introducing
deployment-specific literals (keeps the public mirror diff minimal):

• Identity derived at runtime from inventory + the .local overlay via
  scripts/identity_yaml.load_identity_vars(): realm = platform_domain.split('.')[0],
  admin ids <prefix>-bootstrap-admin / <prefix>-admin-runtime, and
  Keycloak / Headscale / step-ca URLs derived from the domain.
• Welcome-email service list is now generated from
  config/service-capability-catalog.json (public entries), substituting the
  generic example.com for the live domain, grouped by catalog category — no
  more hand-maintained stale list.
• Mail send switched from the broken smtplib-to-docker-hostname path to the
  documented mail-gateway HTTP API (service_url("mail_platform") + /send,
  platform-transactional gateway key) reached via the SSH proxy.
• --dry-run now prints the resolved identity and the fully rendered email.
• PLATFORM_DOMAIN, LV3_KEYCLOAK_REALM, and the existing LV3_*_URL env
  overrides are preserved; an explicit PLATFORM_DOMAIN override now also
  drives the prefix/realm so they can't disagree.

Test plan

• pytest tests/test_provision_operator.py — 12 passed (added coverage for
  identity resolution, domain substitution in the service list, and payload URL
  derivation; updated the mail-gateway helper test).
• --dry-run against the real overlay resolves realm=0mcp,
  https://sso.0mcp.com, and the catalog-driven service list with the live
  domain — and the committed file contains no deployment-specific literals.

🤖 Generated with Claude Code

[baditaflorin]

Extended this PR with a second commit (ca9237b3f): generalized operator_manager.py's realm/admin derivation the same way, and added a client-credentials auth fallback to KeycloakAdminAdapter so recover-totp / reset-password / onboard work against the live realm even when the bootstrap-admin password is stale. No deployment literals committed; verified the module resolves the real realm + admin client and 34/35 tests pass (the one failure, test_repo_operator_roster_validates, is a pre-existing generic-roster vs. real-name mismatch, unrelated to this change).

[prelint]

Critical

scripts/operator_manager.py (line 85) and scripts/provision_operator.py [doc_conflict]: Both scripts now derive KEYCLOAK_REALM / REALM as platform_domain.split('.')[0] via _resolve_identity(), directly contradicting ADR 0056 (Realm: lv3 under "Live Configuration"), versions/stack.yaml (scope_boundary: Keycloak token issuance for the lv3 realm only), and at least six other scripts that continue to hardcode "lv3" directly: scripts/decommission_service.py (argparse default), scripts/uptime_contract.py (CATALOG_KEYCLOAK_REALM = "lv3"), scripts/serverclaw_authz.py (/realms/lv3/ hardcoded), config/windmill/scripts/keycloak-account-expiry-reaper.py ("lv3-admin-runtime" default), and tests/integration/conftest.py (env default "lv3"). The Keycloak realm is an independently configured name — not derivable from the platform domain — so on any deployment where the first DNS label of platform_domain differs from lv3, these two scripts now target a non-existent realm while the rest of the platform continues to target lv3, splitting Keycloak API behavior across operator tooling.

scripts/operator_manager.py (line 88) and scripts/provision_operator.py [access_control]: Both scripts change the bootstrap admin username from the literal "lv3-bootstrap-admin" to f"{CONFIG_PREFIX}-bootstrap-admin". docs/runbooks/identity-taxonomy-and-managed-principals.md documents lv3-bootstrap-admin as the break-glass Keycloak identity, and docs/runbooks/configure-keycloak.md explicitly references "the repo-managed lv3-bootstrap-admin password held on the runtime at /etc/lv3/keycloak/bootstrap-admin-password". If CONFIG_PREFIX resolves to anything other than "lv3" at runtime, the scripts attempt to authenticate with a non-existent user while the documented emergency recovery procedure directs operators to lv3-bootstrap-admin, causing break-glass Keycloak access to fail.