Keycloak Auth Integration Test
Both flows use PKCE (S256) against Keycloak. Registration may be disabled in the realm — Keycloak will show an error if so.