2026-08-23-keycloak-local-seeds

Ordered local Keycloak seeds

• ForgeTrust.AppSurface.Auth.Aspire.Keycloak now exposes an AppHost-only, strictly ordered RealmReady() and WithLocalSeed(...) lifecycle for finite consumer-owned local projects. It keeps Keycloak Admin API clients, credentials, retries, mutation policy, and idempotent application state in the consumer worker while AppSurface supplies only the baseline proof, dependency graph, typed secret-reference validation, and redacted diagnostics.
• Start with the two-worker Keycloak AppHost sample. It demonstrates a persistent, rerun-safe broker/identity/fixture convergence chain and distinguishes startup-time local seeding from request-time DevAuth personas.