PHEE-381: implement in-app Keycloak auth using ROPC flow

[Flashl3opard]

Related

Epic: PHEE-363
Closes: PHEE-379

Summary

Implements full in-app Keycloak authentication using the OAuth2
Resource Owner Password Credentials (ROPC) flow — users authenticate
entirely within our branded UI without being redirected to Keycloak's
login page.

Changes

Keycloak Integration

• Added src/lib/keycloak/keycloak.ts — Keycloak singleton instance
• Added src/lib/keycloak/KeycloakProvider.tsx — initializes Keycloak
  with check-sso, protects all app routes, handles token storage
• Added src/lib/keycloak/useAuth.ts — useAuth() hook exposing
  authenticated, token, user, logout, hasRole

Login Page

• Implemented ROPC flow — credentials collected in our UI, sent directly
  to Keycloak token endpoint
• JWT token stored in localStorage on success
• Error message shown on invalid credentials
• Loading spinner while request is in flight
• Tenant saved to localStorage before navigation

API Client

• Updated src/lib/api/client.ts — changed tenant header to
  Platform-TenantId, added Authorization: Bearer <token>
  from localStorage

AppLayout

• User avatar dropdown shows logged in user name and email from useAuth
• Sign Out button calls keycloak.logout()

Export Features

• Added src/lib/exportCsv.ts — CSV export utility
• Added src/lib/exportPdf.ts — PDF export utility
• Wired to Main Batches, Sub Batches and Transfers tabs

Account Mapper Self Service Portal

• Added src/modules/account-mapper/SelfServicePortal.tsx
• New route /account-mapper/self-service

Notes

• Tested against local Keycloak instance (Docker) with paymenthub
  realm and opsapp client
• Direct Access Grants must be enabled on the Keycloak client

[DavidH-1]

LGTM