feat: add shared Keycloak compose baseline

scripts/verify-stack.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env sh
+set -eu
+
+compose_file=${COMPOSE_FILE:-docker-compose.yml}
+nginx_port=${NGINX_PORT:-8088}
+
+wait_for_url() {
+  name=$1
+  url=$2
+  attempts=30
+
+  while [ "$attempts" -gt 0 ]; do
+    if curl --fail --silent --show-error --output /dev/null "$url"; then
+      return 0
+    fi
+    attempts=$((attempts - 1))
+    sleep 2
+  done
+
+  echo "$name did not become ready: $url" >&2
+  return 1
+}
+
+assert_healthy() {
+  service=$1
+  attempts=30
+
+  while [ "$attempts" -gt 0 ]; do
+    container_id=$(docker compose -f "$compose_file" ps --quiet "$service")
+
+    if [ -n "$container_id" ]; then
+      health=$(docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}' "$container_id")
+      if [ "$health" = "healthy" ]; then
+        return 0
+      fi
+    else
+      health="not-running"
+    fi
+
+    attempts=$((attempts - 1))
+    sleep 2
+  done
+
+  echo "$service is not healthy: $health" >&2
+  return 1
+}
+
+for service in postgres keycloak app nginx; do
+  assert_healthy "$service"
+done
+
+wait_for_url "Keycloak discovery" \
+  "http://localhost:8080/realms/master/.well-known/openid-configuration"
+wait_for_url "Spring Boot health" "http://localhost:8081/actuator/health"
+wait_for_url "nginx health" "http://localhost:${nginx_port}/health"
+wait_for_url "public API" "http://localhost:${nginx_port}/api/public"
+
+protected_status=$(curl --silent --output /dev/null --write-out '%{http_code}' \
+  "http://localhost:${nginx_port}/api/me")
+if [ "$protected_status" != "401" ]; then
+  echo "expected unauthenticated /api/me to return 401, got $protected_status" >&2
+  exit 1
+fi
+
+echo "baseline stack verified: 4 healthy services, public 200, protected 401"