0370135a35
- new deploy/k8s/keycloak/keycloak-bootstrap-job.yaml: one-shot Job that waits for Keycloak, authenticates as admin, creates hwlab realm + hwlab-cloud-web OIDC client via REST API - secret hwlab-cloud-web-client holds the OIDC client_secret used by cloud-api - kustomization.yaml picks up the new Job and Secret - access-control.test.ts: cloud api AgentRun trace records real actor.userId from OIDC-upserted user (issue 788 spec) - access-control.test.ts: cloud api /v1/users/me returns actor with authMethod=api-key for HWLAB_API_KEY Bearer token - 31 pass / 4 pre-existing fail