DevOps

A provisioned Keycloak client inherits no PKCE pin, and the obvious fix is inert

Keycloak 26.7.1, in a realm where every hand-authored client carries "pkce.code.challenge.method": "S256" and refuses plain . Enable the OAuth Clien…