docs(keycloak-session-store): import the session-storage lab as a new project

The keycloak project ended with four open questions that design could not
settle. A two-VM lab was built to answer them by measurement, and this is
that material: 26 experiments, 125 raw command outputs, 22 browser captures.

Follows the import procedure in README.md.

  source/     the originating repository verbatim — 78 documents, 28 SVGs,
              8 manifests, plus .source-revision recording the commit
  final/      the SSOT
    document.md   729 lines written from the 29 experiment documents, not
                  concatenated: what was predicted, what was measured, and
                  where the measurement itself was wrong
    evidence/raw    125 outputs, flattened to <experiment>__<file> because
                    the originals collided (01-baseline.txt appeared three
                    times) and the audit only globs the top level
    evidence/meta   one per raw file; command and exitCode are null and the
                    README says why rather than inventing them
    evidence/browser  22 captures
    assets/       three diagrams through techviz
    .techviz/     their VizSpecs

A separate project rather than an addition to keycloak: the B-layer answers
that project's four questions, but the A, C and D layers are about cluster
failure, SSO and operations, and one document.md should hold one subject.
The four question records there can point here through 관계.

Recorded rather than papered over: only three of the 28 diagrams were
remade. The repository forbids hand-drawn SVG and forbids titles inside the
canvas; all 28 originals carry both, so converting them is redrawing, not
reformatting. They stay in source/ and the gap is written into the document.

verify-pipeline.py passes. audit-records.py reports no issues.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/clean-architecture-backend-template/final/evidence/raw/035a-jpa-cursor-boundary-probe.java

@@ -0,0 +1,30 @@
+import dev.caskeleton.adapter.outbound.persistence.api.query.CursorPayloadCodec;
+import dev.caskeleton.adapter.outbound.persistence.api.query.SignedJsonCursorCodec;
+import java.nio.charset.StandardCharsets;
+
+public class JpaCursorBoundaryProbe {
+  static SignedJsonCursorCodec<String> codecFor(int payloadBytes) {
+    return new SignedJsonCursorCodec<>(new CursorPayloadCodec<>() {
+      public String toJson(String cursor) { return "x".repeat(payloadBytes); }
+      public String fromJson(String json) { return json; }
+    }, "k".repeat(32).getBytes(StandardCharsets.UTF_8));
+  }
+  public static void main(String[] args) {
+    for (int size : new int[]{2045, 2046, 2047, 2048, 2049}) {
+      var codec = codecFor(size);
+      try {
+        String token = codec.encode("ignored");
+        try {
+          String decoded = codec.decode(token);
+          System.out.printf("size=%d tokenChars=%d encode=OK decode=OK decodedBytes=%d%n",
+              size, token.length(), decoded.getBytes(StandardCharsets.UTF_8).length);
+        } catch (RuntimeException ex) {
+          System.out.printf("size=%d tokenChars=%d encode=OK decode=%s:%s%n",
+              size, token.length(), ex.getClass().getSimpleName(), ex.getMessage());
+        }
+      } catch (RuntimeException ex) {
+        System.out.printf("size=%d encode=%s:%s%n", size, ex.getClass().getSimpleName(), ex.getMessage());
+      }
+    }
+  }
+}