M6 (part 2): recipe #2 keycloak install green (DB-backed, no harness surgery)

keycloak+mariadb deployed via only tests/keycloak/recipe_meta.py + test_install.py
(realm health + Playwright admin login). Proves recipe-agnostic enrollment (D5).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/keycloak/recipe_meta.py

@@ -0,0 +1,6 @@
+# Per-recipe harness config for keycloak (DB-backed: keycloak + mariadb). Read by the shared
+# conftest — enrolling this recipe needs NO change to runner/harness code (D5).
+HEALTH_PATH = "/realms/master"          # 200 JSON once keycloak is up (not "/", which redirects)
+HEALTH_OK = (200,)
+DEPLOY_TIMEOUT = 600                     # JVM + DB migration are slow on a 2-vCPU VM
+HTTP_TIMEOUT = 600