M6.5: keycloak upgrade + backup stages (DB data survival via realm marker)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/keycloak/test_backup.py

@@ -0,0 +1,30 @@
+"""keycloak — backup/restore stage (D2): create a realm, backup, delete it (mutate), restore,
+assert the realm is back (mariadb restored to the backed-up state)."""
+import os
+import sys
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
+from harness import lifecycle  # noqa: E402
+import kc_admin  # noqa: E402
+
+
+def test_backup_mutate_restore(deployed):
+    domain = deployed
+    pw = kc_admin.admin_password(domain)
+    tok = kc_admin.admin_token(domain, pw)
+
+    # 1) create the marker realm, then back up
+    assert kc_admin.create_marker_realm(domain, tok) in (201, 409)
+    assert kc_admin.marker_realm_exists(domain, tok)
+    lifecycle.backup_app(domain)
+
+    # 2) mutate: delete the realm
+    assert kc_admin.delete_marker_realm(domain, tok) in (204, 200)
+    assert not kc_admin.marker_realm_exists(domain, tok), "delete did not take"
+
+    # 3) restore -> realm returns
+    lifecycle.restore_app(domain)
+    lifecycle.wait_healthy(domain, path="/realms/master", ok_codes=(200,),
+                           deploy_timeout=600, http_timeout=600)
+    tok2 = kc_admin.admin_token(domain, pw)
+    assert kc_admin.marker_realm_exists(domain, tok2), "restore did not bring back the realm"