Harden Keycloak and ops OIDC session flow

[Abiorh001]

Summary

• run bundled Keycloak in production server mode with Postgres storage and strict hostname/proxy settings
• align Compose Postgres DSNs with the shared password secret and add the Keycloak schema init step
• clear stale ops OIDC/session cookies on auth callback errors and mark auth redirects no-store
• add regression coverage for Keycloak Compose wiring, hosted redirects, and OIDC auth-error cleanup

Validation

• npm test (apps/ops-console)
• uv run pytest tests/test_hosted_deployment_compose.py -q
• docker compose -f docker-compose.yml -f infra/compose/docker-compose.e2e-ports.yml config --quiet

Deployment note

Already deployed and smoke-tested on the EC2 alpha stack after the issue was reproduced.