feat(2): Q3.2 lasuite-drive SSO iteration — keycloak dep + OIDC test + MinIO storage round-trip

- recipe_meta: DEPS=[keycloak] enabled (base proven cold-green).
- setup_custom_tests.sh: wire OIDC env (explicit keycloak realm endpoints) + insert oidc_rpcs
  secret at bumped version + clear FranceConnect eidas1 acr + in-place redeploy (adapted from
  the proven lasuite-docs hook).
- functional/test_oidc_with_keycloak.py: SSO discovery + password grant + JWT claims vs dep
  keycloak realm 'lasuite-drive' (@requires_deps; F2-11 fails run on skip).
- functional/test_minio_storage.py: §4.3 specific — drive-media-storage bucket present + real
  upload->list->download round-trip via mc inside the minio container.
- PARITY.md: OIDC + MinIO rows landed; backup data-integrity (ci_marker) already real.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/lasuite-drive/recipe_meta.py

@@ -17,10 +17,12 @@ HEALTH_OK = (200, 301, 302)
 DEPLOY_TIMEOUT = 1800
 HTTP_TIMEOUT = 900
 
-# NOTE (Phase 2 Q3.2): the keycloak SSO dep + OIDC functional tests land in the SSO iteration once
-# the base deploy/lifecycle is cold-green. Declaring DEPS triggers the orchestrator's
-# setup_custom_tests step (deploy keycloak + wire OIDC), so it stays OFF until the base is proven:
-#   DEPS = ["keycloak"]
+# Base deploy/lifecycle proven cold-green @2026-05-28 (install: pass; 12 services incl.
+# onlyoffice+collabora) once the Docker Hub rate limit was fixed. The keycloak SSO dep is now
+# enabled: declaring DEPS triggers the orchestrator's setup_custom_tests step (deploy keycloak +
+# provision realm/client/user + run tests/lasuite-drive/setup_custom_tests.sh to wire OIDC env +
+# in-place redeploy). functional/test_oidc_with_keycloak.py then exercises the SSO flow.
+DEPS = ["keycloak"]
 
 
 def EXTRA_ENV(domain):