feat(cloud): short function-based subdomains + harden keycloak with postgres

Subdomain rename (Versio side keeps original tool-named hostnames)
- nginx vhosts updated:
    grafana   -> dash.wbd-rd.nl
    gitea     -> git.wbd-rd.nl
    keycloak  -> auth.wbd-rd.nl
    node-red  -> flow.wbd-rd.nl
    mlflow    -> ml.wbd-rd.nl
    jupyter   -> hub.wbd-rd.nl
    portainer -> ops.wbd-rd.nl
    rabbitmq  -> mq.wbd-rd.nl
    jenkins   -> ci.wbd-rd.nl
    mqtt      -> mqtt.wbd-rd.nl   (no Versio conflict assumed)
- nginx-proxy README: bootstrap cert -d list + DNS A-record prereqs updated
- cloud/.env.example: GITEA_ROOT_URL, GRAFANA_ROOT_URL, KEYCLOAK_HOSTNAME

Function-based names are tool-agnostic (a Grafana -> Kibana swap leaves
dash.wbd-rd.nl meaningful) and avoid one-off "*2" suffixes.

Keycloak hardening
- Switch backend from bundled file storage to postgres (keycloak DB
  already provisioned by sql/config/init.d/01-databases.sh).
- KC_HOSTNAME=auth.wbd-rd.nl, KC_PROXY_HEADERS=xforwarded for nginx
  reverse-proxy posture; KC_HTTP_ENABLED=true since nginx terminates TLS.
- Added KC_HOSTNAME_STRICT, KC_HEALTH_ENABLED, KC_METRICS_ENABLED.
- Service joins app + mgmt + data networks (data needed for postgres).
- Mounted config/realms/ for realm-as-code (kc.sh import) — TODO to
  populate once realm + clients are designed.
- README documents the recommended realm structure (wbd realm, one
  client per app with redirect URIs) and the oauth2-proxy approach
  for apps without native OIDC (mlflow, portainer-CE).

cloud
- Uncomment keycloak include in cloud/compose.yml.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

stacks/nginx-proxy/README.md

@@ -64,9 +64,9 @@ docker compose run --rm certbot certonly \
   --webroot -w /var/www/certbot \
   --email "$LETSENCRYPT_EMAIL" --agree-tos --no-eff-email \
   --cert-name infra \
-  -d grafana.wbd-rd.nl  -d gitea.wbd-rd.nl     -d keycloak.wbd-rd.nl \
-  -d nodered.wbd-rd.nl  -d mlflow.wbd-rd.nl    -d jupyter.wbd-rd.nl \
-  -d portainer.wbd-rd.nl -d rabbitmq.wbd-rd.nl -d jenkins.wbd-rd.nl \
+  -d git.wbd-rd.nl   -d auth.wbd-rd.nl  -d dash.wbd-rd.nl \
+  -d flow.wbd-rd.nl  -d ml.wbd-rd.nl    -d hub.wbd-rd.nl \
+  -d ops.wbd-rd.nl   -d mq.wbd-rd.nl    -d ci.wbd-rd.nl \
   -d mqtt.wbd-rd.nl
 
 # 4. Reload nginx to pick up the real cert
@@ -77,19 +77,19 @@ The certbot sidecar then renews every 12h automatically.
 
 ## DNS prereqs (HTTP-01)
 
-Before bootstrap, ensure A records exist in Versio for:
+Before bootstrap, ensure A records exist in Versio for the 10 new short subdomains (the canonical tool-named ones — `gitea.wbd-rd.nl`, `grafana.wbd-rd.nl`, etc. — stay pointed at the existing Versio stack during the transition):
 
 ```
-grafana.wbd-rd.nl     A  <cloud-public-ip>
-gitea.wbd-rd.nl       A  <cloud-public-ip>
-keycloak.wbd-rd.nl    A  <cloud-public-ip>
-nodered.wbd-rd.nl     A  <cloud-public-ip>
-mlflow.wbd-rd.nl      A  <cloud-public-ip>
-jupyter.wbd-rd.nl     A  <cloud-public-ip>
-portainer.wbd-rd.nl   A  <cloud-public-ip>
-rabbitmq.wbd-rd.nl    A  <cloud-public-ip>
-jenkins.wbd-rd.nl     A  <cloud-public-ip>
-mqtt.wbd-rd.nl        A  <cloud-public-ip>
+git.wbd-rd.nl    A  <cloud-public-ip>      # gitea (new)
+auth.wbd-rd.nl   A  <cloud-public-ip>      # keycloak
+dash.wbd-rd.nl   A  <cloud-public-ip>      # grafana (new)
+flow.wbd-rd.nl   A  <cloud-public-ip>      # node-red (new)
+ml.wbd-rd.nl     A  <cloud-public-ip>      # mlflow
+hub.wbd-rd.nl    A  <cloud-public-ip>      # jupyterhub
+ops.wbd-rd.nl    A  <cloud-public-ip>      # portainer
+mq.wbd-rd.nl     A  <cloud-public-ip>      # rabbitmq mgmt UI
+ci.wbd-rd.nl     A  <cloud-public-ip>      # jenkins
+mqtt.wbd-rd.nl   A  <cloud-public-ip>      # MQTT-TLS broker
 ```
 
 ## TODO