Adds an access-gate authentication design: Keycloak OIDC via a backend-driven Authorization Code flow, restricted by realm role, with geniusrun minting its own session cookie. No data model or multi-profile changes. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>