test: codify the three-leg trust chain

scripts/verify-three-leg-trust-chain.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env sh
+set -eu
+
+base="${KEYCLOAK_URL:-http://localhost:8080}"
+main_issuer="$base/realms/keycloak-patterns"
+mock_issuer="$base/realms/mock-google"
+
+test "$(curl -fsS "$main_issuer/.well-known/openid-configuration" | jq -r .issuer)" \
+  = "$main_issuer"
+test "$(curl -fsS "$mock_issuer/.well-known/openid-configuration" | jq -r .issuer)" \
+  = "$mock_issuer"
+
+rg -Fq 'SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_ISSUER_URI:' docker-compose.yml
+if rg -qi 'accounts\\.google\\.com|realms/mock-google' backend/src/main; then
+  echo "backend must trust only the Keycloak issuer, not the upstream IdP" >&2
+  exit 1
+fi
+
+echo "Three-leg trust anchors verified: upstream -> Keycloak -> Resource Server"