docs: add EDP Keycloak Operator v1.35.0 installation guide

[SuJinpei]

Adds the installation guide for EDP Keycloak Operator v1.35.0 (ACP 4.1–4.4), the S2 listing that manages Keycloak configuration as Kubernetes resources.

What the guide covers

• Install and verify the Operator from OperatorHub.
• The Keycloak kind-name clash with Alauda Application Services Identity Management E1, and the fully qualified names to use.
• Using it with Identity Management E1: create an E1 Keycloak instance, connect the Operator through the <name>-initial-admin Secret (spec.auth.passwordGrant), then manage a realm, client, group, role and user as resources, and check that the user can sign in.
• Switching to a dedicated service-account client (spec.auth.clientCredentials), and sharing one connection across namespaces with ClusterKeycloak.
• When to use E1's own KeycloakRealmImport / KeycloakOIDCClient, and when to use this Operator.
• Deletion semantics (the preserve annotation, the delete order), known limitations, uninstall and FAQ.

Validation

Every YAML block and command in the guide was applied verbatim on ACP 4.4.0 (amd64) against Identity Management E1 26.7.4. Each success check was paired with a failing control:

• Both connection methods connected; the wrong-password and wrong-secret controls stayed false.
• The user's token carries the developer realm role, granted through the group.
• A role created after the switch to the service-account client was read back from the Keycloak admin API (200, with a 404 control).
• The preserve annotation kept its realm; a plain delete removed the realm (404).

Multi-arch and IPv6 support come from the v1.35.0 release testing on ACP 4.1–4.4.

Notes

• New file, so there is no id: field. The docs workflow assigns it on merge.
• English only; the zh version is generated by the pipeline.

🤖 Generated with Claude Code