feat(management-api): Integrate Keycloak Auth and CDA Token Passthrough

[vairav]

Summary

• Integrates Keycloak OIDC authentication into the Management API
• Adds CDA service for fetching users/roles from CWMS Data API
• Implements token passthrough from Management API to CDA
• Adds comprehensive unit tests for CLI modules

Changes

Management API

• KeycloakAuthService (new): Handles login, logout, refresh, and JWKS-based token validation
• CdaService (new): Fetches users and roles from CWMS Data API with auth token passthrough
• auth.middleware.ts: Updated to validate tokens via Keycloak JWKS instead of placeholder logic
• auth.ts routes: Updated login/logout/refresh endpoints to use Keycloak
• users.ts/roles.ts routes: Added token extraction and passthrough to CdaService

CLI

• cwms-admin.sh: New wrapper script for running CLI via tsx during development
• project.json: Updated build configuration

Configuration

• docker-compose.podman.yml: Added Keycloak environment variables (KEYCLOAK_URL, KEYCLOAK_REALM, KEYCLOAK_CLIENT_ID) and fixed CDA_API_URL

Tests

• validation.test.ts: 32 unit tests for createRoleSchema and createUserSchema
• config.test.ts: 11 unit tests for getConfig, saveConfig, and clearConfig

Test Plan

• All 64 CLI unit tests pass
• Login endpoint returns valid Keycloak token
• Token validation works via JWKS
• Users/roles endpoints pass token to CDA service

Notes

The CWMS Data API may return 401 if its issuer configuration doesn't match the Keycloak container network URL. This is a deployment configuration issue, not a code issue.