feat: jpa, messaging, notification, mongo, graphql 어댑터터 리펙토링

infra/keycloak/entrypoint.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Reads the client secret from its mounted file, exports it for the realm import, and execs Keycloak.
+#
+# The realm artifact carries ${KEYCLOAK_GRAPHQL_SMOKE_CLIENT_SECRET} rather than a value, so the
+# secret is never in Git. Passing it as a container `environment:` entry would have put it in the
+# rendered Compose config and in `docker inspect`; a file read here keeps it process-local.
+set -euo pipefail
+
+SECRET_FILE="/run/secrets/keycloak-graphql-smoke-client-secret"
+if [[ ! -r "${SECRET_FILE}" ]]; then
+  echo "keycloak entrypoint: ${SECRET_FILE} is not readable." >&2
+  echo "  The lane wrapper writes it per run at mode 0600; running this stack by hand needs one too." >&2
+  exit 78
+fi
+
+KEYCLOAK_GRAPHQL_SMOKE_CLIENT_SECRET="$(cat "${SECRET_FILE}")"
+export KEYCLOAK_GRAPHQL_SMOKE_CLIENT_SECRET
+if [[ -z "${KEYCLOAK_GRAPHQL_SMOKE_CLIENT_SECRET}" ]]; then
+  echo "keycloak entrypoint: the client secret file is empty." >&2
+  exit 78
+fi
+
+exec /opt/keycloak/bin/kc.sh start-dev --import-realm