Add SSO E-Cosplay (Keycloak OIDC) and dynamic navbar active state

- Install knpuniversity/oauth2-client-bundle and stevenmaguire/oauth2-keycloak
- Register KnpUOAuth2ClientBundle in bundles.php
- Configure Keycloak OIDC client (realm e-cosplay, auth.esy-web.dev)
- Add keycloakId field to User entity with migration
- Create KeycloakAuthenticator with group-to-role mapping (/superadmin -> ROLE_ROOT)
- Create OAuthController with SSO routes (/connection/sso/login, logout, check)
- Add custom_authenticator to security firewall with form_login entry point
- Add auth.esy-web.dev to nelmio external_redirects whitelist and CSP form-action
- Add SSO button and error flash messages to login page
- Make navbar active state dynamic based on current route (desktop + mobile)
- Add Keycloak env vars to .env, .env.local, and ansible/env.local.j2

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.env

@@ -47,6 +47,13 @@ STRIPE_WEBHOOK_SECRET=
 STRIPE_MODE=test
 SMIME_PASSPHRASE='KLreLnyR07x5h#3$AC'
 
+###> SSO E-Cosplay (Keycloak OIDC) ###
+OAUTH_KEYCLOAK_CLIENT_ID=e-ticket
+OAUTH_KEYCLOAK_CLIENT_SECRET=changeme
+OAUTH_KEYCLOAK_URL=https://auth.esy-web.dev
+OAUTH_KEYCLOAK_REALM=e-cosplay
+###< SSO E-Cosplay (Keycloak OIDC) ###
+
 ###> s3/minio ###
 S3_ENDPOINT=http://minio:9000
 S3_ACCESS_KEY=e-ticket