Run Playwright E2E tests through a real OAuth/OIDC redirect flow using a disposable test identity provider instead of production credentials

Steps

1. Stand up a test IdP such as Keycloak in dev mode (single Docker container) with a test realm JSON defining throwaway clients, users, and roles, imported fresh on every CI run for reproducibility
2. Let the app redirect to the real test IdP login page during the test and fill its login form with test-only credentials from environment/config, never production accounts
3. Prefer exercising the actual redirect chain and token validation over stubbing the OAuth response directly, since disabling validation tests a different code path than production
4. Once authenticated once through the real flow, capture the resulting session via storageState() and reuse it across other tests to avoid repeating the redirect every time
5. For popup-based OAuth flows, register page.waitForEvent('popup') before clicking the button that opens the IdP popup, or the popup reference is missed