RBAC Phase 1: membership authority endpoint + fail-closed API auth (#14)

Implements the model-B2 membership authority (ratified compliance auth design) and inbound token verification.

- GET /v1/users/{id}/memberships: Keycloak supplies user->tenant links + org_roles (attribute projection until the realm migrates to Organizations); registered tenants override status/plan/products from registry tables (source: registry|keycloak). Closes the M5.2-deferred org_roles stub.
- New internal/authn: OIDC discovery + JWKS verification (go-oidc/v3), audience tenant-registry. /healthz + /readyz stay PUBLIC_EXPLICIT; all other routes INTERNAL_SERVICE_ONLY. AUTH_ENABLED=true refuses to start on incomplete config (fail-closed); false (dev default) keeps current behavior.
- Full suite green incl. postgres testcontainers; openapi.yaml updated (contract test passes).

Activation is a separate step (Auth-5): requires the orca-infra env merge and a portal service token (portal currently calls with no auth).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Sharang Parnerkar <30073382+mighty840@users.noreply.github.com>
Reviewed-on: #14

internal/keycloak/adapter.go

@@ -25,6 +25,7 @@ var (
 	ErrOrgConflict  = errors.New("keycloak: organization already exists")
 	ErrUserConflict = errors.New("keycloak: user already exists")
 	ErrUnavailable  = errors.New("keycloak: unreachable")
+	ErrUserNotFound = errors.New("keycloak: user does not exist")
 )
 
 // InviteInput captures the per-tenant onboarding event from POST /v1/tenants.
@@ -73,6 +74,14 @@ type Adapter interface {
 	// flows, M14.x cancel, M12.x trial transitions).
 	SyncClaims(ctx context.Context, userID string, c Claims) error
 
+	// Memberships resolves the tenants user userID (the Keycloak user id,
+	// i.e. the JWT `sub`) belongs to, as Keycloak records them. The realm
+	// has no Organizations yet, so this reads the user's attribute
+	// projection — zero or one memberships. When the realm migrates to
+	// Organizations this becomes an org-membership query and callers keep
+	// working unchanged. Returns ErrUserNotFound for an unknown user id.
+	Memberships(ctx context.Context, userID string) ([]Claims, error)
+
 	// Health pings the admin endpoint. Used by readyz and the cluster cold-
 	// start sequence (INFRASTRUCTURE.md §10 scenario F).
 	Health(ctx context.Context) error