Part of the epic pyronear/roadmap#23 (Keycloak).

Context & objective

We want to move user authentication to a Keycloak service (SSO, user management, password policies, MFA…).
This will be done in steps: this issue covers user authentication only. Camera authentication must keep working as is.

Follow-up: camera authentication via Keycloak (#699 ).

What is done currently

• Users are stored in the users table (login, bcrypt password, role, organization_id). No other table references it.
• Users log in via POST /login/creds and receive an API-signed JWT (JWT_SECRET, HS256).
• Routes are protected by get_jwt / get_current_user, using scopes (admin, agent, user, camera) and organization_id from the token.
• Camera tokens are issued separately via POST /cameras/{id}/token (same JWT mechanism, camera scope).
• GET /login/validate isn't used by any client.

What has to be done

• Validate Keycloak-issued tokens for user routes (realm JWKS) and map claims → TokenPayload (sub, roles → scopes, organization_id).
• Move users to Keycloak: role and organization_id held there (roles / attribute or group).
• Throwaway script for a one-shot manual migration of existing users.
• Remove the users table, /users routes, /login/creds and /login/validate.
• Keep API-issued camera tokens (/cameras/{id}/token) working, with no change on devices.
• Update clients currently using /login/creds: new-pyro-platform, pyro-envdev init scripts, pyro-annotator ingestion client (→ Keycloak service account).

Technical considerations

• During this step the API receives two kinds of tokens: Keycloak-signed (users, verified with the realm public keys) and API-signed (cameras, verified with JWT_SECRET). Read the token's iss claim to pick the right verification.
• TokenPayload.sub is typed int, but a Keycloak user sub is a UUID string. Allow both, or split user and camera payloads (for cameras, sub is still used as camera_id, e.g. in poses.py).
• User management (create, roles, org) is done in Keycloak from now on.
• Dev & e2e: rely on the Keycloak service in pyro-envdev (feat: add service keycloak pyro-envdev#45). Keycloak deployment on prod is out of scope.
• Keep the issuer dispatch simple and isolated, so that the API-issued path can be dropped once cameras are migrated.