feat(auth): implement Keycloak authentication with RBAC and pagination

Major changes:
- Add Keycloak integration via token introspection endpoint
- Implement RBAC system with roles: admin, user, guest
- Add role-based permissions for post operations
- Add pagination support (default limit: 10) to list endpoints
- Add published_only filter with admin-only override for unpublished posts

Security improvements:
- Remove hardcoded default secrets (SECRET_KEY, KEYCLOAK_CLIENT_SECRET)
- Update .env.example with proper security placeholders
- Add comprehensive RBAC unit tests

Infrastructure:
- Add httpx dependency for HTTP client
- Add KeycloakAuthClient with token caching (TTL: 60s)
- Add role-based dependencies (RequireAdmin, RequireUser, etc.)
- Update DI container with Keycloak provider

Endpoints updated:
- GET /posts: filter by published status (admin can see all)
- Add pagination params (limit, offset) to list endpoints
- Enforce RBAC on post operations

Tests:
- Add 16 auth infrastructure tests
- Add 13 RBAC role tests
- Update existing tests for new required settings

Breaking changes:
- SECRET_KEY and KEYCLOAK_CLIENT_SECRET now required (no defaults)

app/main.py

@@ -12,6 +12,7 @@ from fastapi.middleware.cors import CORSMiddleware
 from app.infrastructure import close_db, init_db, register_exception_handlers, settings
 from app.infrastructure.di.providers import (
     DatabaseProvider,
+    KeycloakProvider,
     RepositoryProvider,
     TransactionManagerProvider,
     UseCaseProvider,
@@ -32,11 +33,11 @@ async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
 def app_factory() -> FastAPI:
     """Create and configure FastAPI application."""
     app = FastAPI(
-        title=settings.app_name,
-        debug=settings.debug,
+        title=settings.app.name,
+        debug=settings.app.debug,
         lifespan=lifespan,
-        docs_url="/docs" if settings.debug else None,
-        redoc_url="/redoc" if settings.debug else None,
+        docs_url="/docs" if settings.is_dev else None,
+        redoc_url="/redoc" if settings.is_dev else None,
     )
 
     # Setup Dishka DI container
@@ -45,6 +46,7 @@ def app_factory() -> FastAPI:
         RepositoryProvider(),
         TransactionManagerProvider(),
         UseCaseProvider(),
+        KeycloakProvider(),
     )
     setup_dishka(container, app)
 
@@ -66,7 +68,11 @@ def app_factory() -> FastAPI:
     # Health check endpoint
     @app.get("/health", tags=["health"])
     async def health_check() -> dict[str, str]:
-        return {"status": "ok", "app": settings.app_name}
+        return {
+            "status": "ok",
+            "app": settings.app.name,
+            "env": settings.environment.value,
+        }
 
     return app
 
@@ -76,8 +82,8 @@ def main() -> None:
     uvicorn.run(
         app_factory,
         factory=True,
-        host=settings.host,
-        port=settings.port,
+        host=settings.app.host,
+        port=settings.app.port,
     )