docs: B-0 — deploy the BFF and read what autoconfiguration actually chose

The authorized client repository is AuthenticatedPrincipalOAuth2AuthorizedClientRepository, keyed by principal with no session id in it, which is the mechanism behind the sharing problem Q1 and Q3 describe. Sharing a store does not fix a lookup key.

Five problems on the way in: only build output was committed under bff/, a duplicate YAML key broke the image build and was invisible until the full log was captured, env placeholders without defaults broke the tests, actuator was behind the login redirect so a 200 was the login page, and the 117KB beans response failed through the proxy.

Deploying two replicas made the login itself fail before any experiment started, because the authorization request lives in per-instance memory and the callback lands elsewhere.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/evidence/b0-bff-redis-deploy/01-deploy.txt

@@ -0,0 +1,21 @@
+=== 배포 전 자원 ===
+Mem:           11648        7329         280           4        4377        4319
+NAME       CPU(cores)   CPU(%)   MEMORY(bytes)   MEMORY(%)   
+kc-lab-1   115m         5%       2192Mi          44%         
+kc-lab-2   121m         6%       1324Mi          33%         
+
+=== 배포 ===
+secret/bff-secrets created
+deployment.apps/redis created
+service/redis created
+deployment.apps/bff created
+service/bff created
+ingress.networking.k8s.io/bff created
+
+deployment "redis" successfully rolled out
+Waiting for deployment "bff" rollout to finish: 1 of 2 updated replicas are available...
+deployment "bff" successfully rolled out
+
+bff-574c6d658b-8cz4x        true   kc-lab-1
+bff-574c6d658b-zpkbp        true   kc-lab-2
+redis-568bd7c4-5c5vc        true   kc-lab-2

docs/evidence/b0-bff-redis-deploy/02-autoconfiguration.txt

@@ -0,0 +1,13 @@
+=== B-0: 자동구성이 실제로 고른 구현체 ===
+  Q1 확인한 사실: "코드에 저장소를 직접 생성하는 Bean 이 없기 때문에,
+   어떤 구현체가 실제로 사용되는지는 자동구성 결과까지 확인해야 정확하게 알 수 있다"
+
+  File "<stdin>", line 9
+    print(f"    {name:46} {t.rsplit(\".\",1)[-1]}")
+                                     ^
+SyntaxError: unexpected character after line continuation character
+
+=== HttpSession 은 어디에 있는가 (서블릿 컨테이너 기본) ===
+
+=== 외부 진입점 ===
+  https://app1.hyeonworks.com/  HTTP 200

docs/evidence/b0-bff-redis-deploy/03-beans-analysis.txt

@@ -0,0 +1,29 @@
+=== B-0 — 자동구성이 실제로 고른 구현체 ===
+  컨텍스트: keycloak-bff
+  전체 빈 수: 321
+
+  --- 세션 · 토큰 저장소 관련 ---
+    authorizedClientManager                        -> AuthorizedClientServiceOAuth2AuthorizedClientManager
+    authorizedClientManagerRegistrar               -> OAuth2ClientConfiguration$OAuth2AuthorizedClientManagerRegistrar
+    authorizedClientRepository                     -> AuthenticatedPrincipalOAuth2AuthorizedClientRepository
+    authorizedClientService                        -> InMemoryOAuth2AuthorizedClientService
+    org.springframework.boot.autoconfigure.security.oauth2.client.OAuth2ClientConfigurations$OAuth2AuthorizedClientServiceConfiguration -> OAuth2ClientConfigurations$OAuth2AuthorizedClientServiceConfiguration
+    org.springframework.security.config.annotation.web.configuration.OAuth2ClientConfiguration$OAuth2AuthorizedClientManagerConfiguration -> OAuth2ClientConfiguration$OAuth2AuthorizedClientManagerConfiguration
+
+  --- OAuth2 클라이언트 관련 전체 ---
+    authorizedClientManager                        -> AuthorizedClientServiceOAuth2AuthorizedClientManager
+    authorizedClientManagerRegistrar               -> OAuth2ClientConfiguration$OAuth2AuthorizedClientManagerRegistrar
+    authorizedClientRepository                     -> AuthenticatedPrincipalOAuth2AuthorizedClientRepository
+    authorizedClientService                        -> InMemoryOAuth2AuthorizedClientService
+    clientRegistrationRepository                   -> InMemoryClientRegistrationRepository
+    org.springframework.boot.autoconfigure.security.oauth2.client.OAuth2ClientAutoConfiguration -> OAuth2ClientAutoConfiguration
+    org.springframework.boot.autoconfigure.security.oauth2.client.OAuth2ClientConfigurations$ClientRegistrationRepositoryConfiguration -> OAuth2ClientConfigurations$ClientRegistrationRepositoryConfiguration
+    org.springframework.boot.autoconfigure.security.oauth2.client.OAuth2ClientConfigurations$OAuth2AuthorizedClientServiceConfiguration -> OAuth2ClientConfigurations$OAuth2AuthorizedClientServiceConfiguration
+    org.springframework.boot.autoconfigure.security.oauth2.client.servlet.OAuth2ClientWebSecurityAutoConfiguration -> OAuth2ClientWebSecurityAutoConfiguration
+    org.springframework.security.config.annotation.web.configuration.OAuth2ClientConfiguration -> OAuth2ClientConfiguration
+    org.springframework.security.config.annotation.web.configuration.OAuth2ClientConfiguration$OAuth2AuthorizedClientManagerConfiguration -> OAuth2ClientConfiguration$OAuth2AuthorizedClientManagerConfiguration
+    org.springframework.security.config.annotation.web.configuration.OAuth2ClientConfiguration$OAuth2ClientWebMvcSecurityConfiguration -> OAuth2ClientConfiguration$OAuth2ClientWebMvcSecurityConfiguration
+    spring.security.oauth2.client-org.springframework.boot.autoconfigure.security.oauth2.client.OAuth2ClientProperties -> OAuth2ClientProperties
+
+  --- Redis / Spring Session 이 구성되었는가 ---
+    ★ 없음 — Redis 도 Spring Session 도 구성되지 않았다

docs/evidence/b0-bff-redis-deploy/README.md

@@ -0,0 +1,18 @@
+# B-0 — BFF·Redis 배포와 자동구성 확인 증거
+
+2026-09-04 14:20–14:50 KST
+해설: [`docs/experiment-b0-bff-redis-deploy.md`](../../experiment-b0-bff-redis-deploy.md)
+
+| 파일 | 무엇을 보여주는가 |
+|---|---|
+| `01-deploy.txt` | 배포 전 자원, Redis·BFF 롤아웃, 두 노드에 하나씩 배치됨 |
+| `02-autoconfiguration.txt` | 첫 조회 시도(파싱 실패)와 **외부 진입점 `HTTP 200`** |
+| `03-beans-analysis.txt` | **B-0 의 답** — `InMemoryOAuth2AuthorizedClientService`, `AuthenticatedPrincipalOAuth2AuthorizedClientRepository`, **Redis·Spring Session 없음** |
+| `b0-bff-login-success-single-replica.png` | replica 1 에서 로그인 성공한 BFF 화면 |
+| `b0-bff-token-boundary.png` | `/bff/token-boundary` — `principal: labuser`, `accessTokenStoredOnServer: true`, **`browserTokenCount: 0`** |
+
+## 핵심 세 줄
+
+1. **`AuthenticatedPrincipalOAuth2AuthorizedClientRepository`** — 조회 키가 principal 이고 session ID 가 없다. Q1·Q3 문제의 기제가 이 빈 하나에 있다.
+2. **Redis 를 붙여도 그건 안 고쳐진다.** 저장소 공유와 조회 키는 다른 문제다.
+3. **replica 2개에서는 로그인 자체가 실패한다.** 인가 코드 흐름의 왕복 두 번이 같은 인스턴스로 가야 하는데, 인가 요청이 인스턴스 메모리에 있다.