feat(core): scaffold account manager platform

docs/admin-oidc-keycloak-setup.md

@@ -0,0 +1,24 @@
+# Admin OIDC setup
+
+The admin console will use Keycloak OIDC and JWT-backed Auth.js sessions, following the established pattern in the sibling Retro application.
+
+## Application environment
+
+- `AUTH_SECRET`
+- `APP_URL`
+- `KEYCLOAK_ISSUER_URL`
+- `KEYCLOAK_CLIENT_ID`
+- `KEYCLOAK_CLIENT_SECRET`
+- `KEYCLOAK_REQUIRED_ROLE` (defaults to `minecraft-account-manager-admin`)
+
+## Keycloak client
+
+Create a confidential OpenID Connect client with standard authorization code flow enabled and direct access grants disabled.
+
+Recommended client ID: `minecraft-account-manager-admin`
+
+Allow exact callback and logout URLs for each environment. Avoid wildcard origins and redirect URLs.
+
+Create the realm role `minecraft-account-manager-admin` and assign it directly or through an admin group. Ensure realm roles are emitted in `realm_access.roles`.
+
+The admin console will reject sign-in when the required role is absent, even when Keycloak authentication itself succeeds.