Add Keycloak Admin API integration for “invite/create user” + optional enrichment

[JulienLouisSchneider]

Issue 8 — (Next step) Add Keycloak Admin API integration for “invite/create user” + optional enrichment

Description

Enable the “chef” to create users directly from your UI. Backend will create the Keycloak user using a service account, then create the membership row. Optionally enrich member listing with email/name from Keycloak without storing it locally.

Checklist

• Create Keycloak client backend-admin with:

  • service account enabled

  • roles: manage-users, view-users, query-users (minimum needed)

• Add env vars to .env.example:

  • KEYCLOAK_BASE_URL, KEYCLOAK_REALM

  • KEYCLOAK_ADMIN_CLIENT_ID, KEYCLOAK_ADMIN_CLIENT_SECRET

• Implement Go client for Keycloak Admin API (client credentials):

  • create user

  • set required actions VERIFY_EMAIL, UPDATE_PASSWORD (or password temp)

  • disable user (optional)

  • get user by id (for enrichment)

• Implement POST /companies/:id/members to:

  • authorize “chef”

  • create Keycloak user

  • insert membership row

  • rollback best-effort if DB insert fails (disable user)

• (Optional) GET /companies/:id/members enrichment with Keycloak email/name (with caching).

Acceptance Criteria

• Owner can create a Keycloak user via backend endpoint.

• Membership row is created automatically and consistent.

• No Keycloak admin credentials are exposed to the frontend.