Keycloak SSO

Adds Keycloak single sign-on to Payload CMS 3 via an OIDC auth strategy with PKCE, silent token refresh, and permission-based access control.