M6 (part 2): recipe #2 keycloak install green (DB-backed, no harness surgery)

keycloak+mariadb deployed via only tests/keycloak/recipe_meta.py + test_install.py
(realm health + Playwright admin login). Proves recipe-agnostic enrollment (D5).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

JOURNAL.md

@@ -409,3 +409,17 @@ harness-code change (D5):
 
 **Next:** mirror hedgedoc (postgres+hedgedoc, DB-backed) via the mirror+PR flow with a committed
 tests/ dir, write tests/hedgedoc/ (install/upgrade/backup + recipe_meta), run all stages + D4 green.
+
+## 2026-05-27 — M6 (part 2): recipe #2 keycloak install green (DB-backed, no harness surgery)
+
+Enrolled keycloak (recipe #2): keycloak 26.6.2 **+ mariadb 12.2** — genuinely DB-backed/multi-service
+(vs custom-html stateless). Added only `tests/keycloak/recipe_meta.py` (HEALTH_PATH=/realms/master,
+HEALTH_OK=(200,), 600s timeouts) + `tests/keycloak/test_install.py` (realm-endpoint health +
+Playwright admin-console login). **No change to runner/harness code** — the recipe-agnostic harness
+(per-recipe meta) handled it (D5 evidence).
+
+Run: `RECIPE=keycloak STAGES=install cc-ci-run runner/run_recipe_ci.py` → 2 passed in 545s (keycloak
+is slow: image pull + JVM + mariadb migration). Teardown clean (0 keyc-* services/volumes after).
+
+**Next:** D4 demo via a mirror shipping committed tests/ (recipe-local run against live app); then
+keycloak upgrade + backup/restore (DB data survival via a realm marker through the admin API).