- Add KeycloakAuthenticatorTest: supports, success/failure redirects, user creation, email linking, user update, /superadmin group to ROLE_ROOT mapping, unknown groups - Add OAuthControllerTest: SSO login redirects to Keycloak, SSO logout redirects to home - Add SSO button presence test to SecurityControllerTest Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>