feat(auth): implement web authentication with Keycloak OAuth2

- Add auth routes: /auth/login, /auth/callback, /auth/logout
- Add OAuth2 flow with Keycloak using HTTP-only cookies
- Add web auth dependencies with role checking
- Add profile page (read-only) at /web/profile
- Update header with user menu (sign in/out, profile)
- Filter posts based on user permissions (hide drafts from guests)
- Conditionally show/hide create/edit/delete buttons
- Add authorization rules documentation to AGENTS.md
- Secure post editing/deletion endpoints with auth checks
- Add can_edit, can_delete flags to templates

app/presentation/web/__init__.py

@@ -8,6 +8,7 @@ The web layer follows the same DDD principles as the API layer and will
 be integrated with use cases in future iterations.
 """
 
+from app.presentation.web.auth import router as auth_router
 from app.presentation.web.routes import router
 
-__all__ = ["router"]
+__all__ = ["router", "auth_router"]