feat(1d): enroll hedgedoc in bridge POLL_REPOS (DG6 unconfigured-recipe target)

hedgedoc mirrored to recipe-maintainers/hedgedoc with probe PR #1; add it to the bridge poll list so
!testme triggers the full generic suite (no cc-ci/repo-local overlay -> pure generic). Rebuild pending.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

nix/modules/bridge.nix

@@ -40,7 +40,7 @@ let
           # admin-registered push optimization deduped against the poller (§4.1). Enrollment = add
           # the repo to POLL_REPOS (csv) + ensure tests/<recipe>/ exists.
           - POLL_INTERVAL=30
-          - POLL_REPOS=recipe-maintainers/cc-ci,recipe-maintainers/custom-html,recipe-maintainers/keycloak,recipe-maintainers/cryptpad,recipe-maintainers/matrix-synapse,recipe-maintainers/lasuite-docs,recipe-maintainers/n8n
+          - POLL_REPOS=recipe-maintainers/cc-ci,recipe-maintainers/custom-html,recipe-maintainers/keycloak,recipe-maintainers/cryptpad,recipe-maintainers/matrix-synapse,recipe-maintainers/lasuite-docs,recipe-maintainers/n8n,recipe-maintainers/hedgedoc
           - HMAC_FILE=/run/secrets/webhook_hmac
           - DRONE_TOKEN_FILE=/run/secrets/drone_token
           - GITEA_TOKEN_FILE=/run/secrets/gitea_token

tests/keycloak/test_backup.py

@@ -22,6 +22,11 @@ def test_backup_captures_state(live_app, meta):
     snap = generic.do_backup(domain)
     assert snap, "backup produced no snapshot artifact"
 
+    # backup-bot-two cycles the keycloak container during backup, so the admin API is briefly 502.
+    # Wait for it to be serving again, then re-auth, before mutating via the HTTP admin API.
+    generic.assert_serving(domain, meta)
+    tok = kc_admin.admin_token(domain, pw)
+
     # 2) mutate: delete the realm (diverge from the backup)
     assert kc_admin.delete_marker_realm(domain, tok) in (204, 200)
     assert not kc_admin.marker_realm_exists(domain, tok), "delete did not take"