fix(k8s): stabilize keycloak rollout and align CD deploy manifests

Update Keycloak probe/realm import behavior and authority config so auth services start reliably on the dev cluster, while keeping CD deployment steps aligned with the actual Kubernetes overlay behavior.

infra/k8s/base/configmap.yaml

@@ -9,6 +9,8 @@ data:
   cors-origins: "http://localhost:3000"
   api-base-url: "http://workclub-api"
   keycloak-url: "http://workclub-keycloak"
+  keycloak-authority: "http://workclub-keycloak/realms/workclub"
+  keycloak-audience: "workclub-api"
   keycloak-realm: "workclub"
   
   # Database configuration
@@ -39,3 +41,18 @@ data:
     \c workclub
     GRANT ALL PRIVILEGES ON SCHEMA public TO app;
     ALTER SCHEMA public OWNER TO app;
+
+    -- App admin role for RLS bypass policies used by API startup seed
+    DO $$
+    BEGIN
+      IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'app_admin') THEN
+        CREATE ROLE app_admin;
+      END IF;
+    END
+    $$;
+    GRANT app_admin TO app WITH INHERIT FALSE, SET TRUE;
+    GRANT USAGE ON SCHEMA public TO app_admin;
+    GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO app_admin;
+    GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO app_admin;
+    ALTER DEFAULT PRIVILEGES FOR ROLE app IN SCHEMA public GRANT ALL ON TABLES TO app_admin;
+    ALTER DEFAULT PRIVILEGES FOR ROLE app IN SCHEMA public GRANT ALL ON SEQUENCES TO app_admin;