ADR-0007: Keycloak token validation boundary

• Status: Accepted
• Date: 2026-04-11

Decision

Backend validates bearer tokens via JWKS and issuer/audience checks. Frontend keeps provider-specific details inside auth adapter boundaries.