Getting a Keycloak token past Spring Security takes ten lines. Deciding who may touch which record takes design. Four authorization layers, identity keyed on (issuer, subject), several issuers routed on iss, and why we refuse to build a dev auth bypass.
