- Declare the 10 application groups (gp_asso, gp_contest, gp_mail, gp_mailling, gp_member, gp_ndd, gp_sign, gp_ticket, super_admin_asso, superadmin) in the realm import JSON for fresh installs. - Extend keycloak-init to idempotently create them via kcadm on every boot, so existing installs (where the realm is already imported and --import-realm is a no-op) also get them in sync. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>