fix(keycloak): org create must send a domain (KC 26 rejects domainless) (#20)

internal/keycloak/client_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -24,6 +25,7 @@ type stubKC struct {
 	emailCalls  atomic.Int32
 	healthCalls atomic.Int32
 	syncCalls   atomic.Int32
+	lastOrgBody string
 
 	tokenFails atomic.Bool // when true, /token returns 401 once
 }
@@ -53,6 +55,8 @@ func newStubKC(t *testing.T) *stubKC {
 	mux.HandleFunc("/admin/realms/test-realm/organizations", func(w http.ResponseWriter, r *http.Request) {
 		s.orgCalls.Add(1)
 		if r.Method == http.MethodPost {
+			body, _ := io.ReadAll(r.Body)
+			s.lastOrgBody = string(body)
 			w.Header().Set("Location", s.srv.URL+"/admin/realms/test-realm/organizations/org-xyz")
 			w.WriteHeader(http.StatusCreated)
 			return
@@ -135,6 +139,12 @@ func TestHTTPAdapter_createOrgAndInvite(t *testing.T) {
 		t.Errorf("call counts: org=%d user=%d member=%d email=%d",
 			s.orgCalls.Load(), s.userCalls.Load(), s.memberCalls.Load(), s.emailCalls.Load())
 	}
+	// KC 26 rejects a domainless org; the adapter must send a synthetic
+	// per-slug domain so onboarding actually provisions.
+	if !strings.Contains(s.lastOrgBody, `"domains"`) ||
+		!strings.Contains(s.lastOrgBody, "acme.tenant.breakpilot.com") {
+		t.Errorf("org create body missing synthetic domain: %s", s.lastOrgBody)
+	}
 }
 
 func TestHTTPAdapter_emailMissingAdminEmailRejected(t *testing.T) {