[DT-507] fix(security): require Keycloak login on all APIs and harden the backend

[devajipatil]

Require login on all APIs, and general security hardening

Why this change was needed

The backend has APIs to deploy and delete EDC connectors, DTRs and submodel
servers. These APIs were supposed to be protected by an API key.

They were not protected at all.

The code looked for the setting authorization at the top of the config
file, but in the config file that setting lives one level down, inside
appConfig. Because the code looked in the wrong place, it found nothing,
assumed "protection is switched off", and let every request through.

In practice: anyone who could reach the backend URL could list every
company's deployments, deploy new ones, and delete existing ones, without
logging in and without any password or key.

Separately, a few other things were unsafe:

• If someone sent a fake or expired login token, the backend ignored the
  problem and carried on instead of refusing the request.
• There was a switch (KEYCLOAK_VERIFY_SIGNATURE=false) that turned off
  token checking completely.
• The backend accepted any HTTPS certificate when calling connectors, so
  traffic could be intercepted.
• Database passwords were just the component's name plus "-password"
  (for example my-edc-password), and the component name is shown in the
  UI. So the password was guessable by anyone looking at the dashboard.
• Every deployment request was written into the log file in full, including
  the database credentials it carried.
• The login token was copied into the browser's localStorage, where it
  stayed after logout and could be stolen by any script on the page.

What changed

Login is now required. All 11 API routes require a valid Keycloak token.
The backend checks the signature against Keycloak's public keys, checks the
token came from the right Keycloak realm, checks it has not expired, and
checks it was issued for this application. If any check fails, the request
gets 401 Unauthorized.

The API-key path was deleted. It never actually protected anything, so
removing it is safe and means one less thing to maintain.

Both ways of skipping the checks were removed. There is no longer any
code path that reads a token without verifying it.

HTTPS certificates are now verified on all outbound calls (6 places).

Database passwords are now generated by the backend — 24 random
characters. Components that already exist keep their current password, so
upgrading a running component cannot break its database.

Leaks closed. Deployment logs now record only the component type and
name. The token is no longer stored in localStorage (and any old copy is
deleted when the page loads). The frontend no longer invents a password
value to keep in memory.

Safer defaults. CORS only allows the console's own address instead of
allowing everything. /docs, /redoc and /openapi.json are no longer
public. The frontend now sends standard security headers (HSTS,
X-Frame-Options, nosniff, Referrer-Policy).

Files changed (12 files, +105 / -155)

File	What
backend/auth/keycloak_config.py	removed the verification off-switch and the "ignore bad token" helper; added the check that the token was issued for this app
backend/init.py	login required on all routes; API-key code removed; server-generated DB passwords; CORS allowlist; docs disabled; log leaks fixed
backend/managers/edcManager.py	HTTPS certificates verified (4 calls)
backend/service/edcService.py	HTTPS certificates verified (2 calls)
backend/config/configuration.yml	fixed a stale Keycloak URL that pointed at a host no environment uses
backend/tests/test_identity.py	removed 3 tests that checked the behaviour we just deleted
frontend/.nginx/nginx.conf	added security headers
frontend/src/api/client.ts, main.tsx	token no longer stored in localStorage
frontend/src/AppNew.tsx, ComponentWizard.tsx, utils/deployment.ts	stopped inventing a password value

Before you deploy — one required step

Add EMC_ALLOWED_ORIGINS to backend.env in each chart values file, set to
the address of the console frontend (not the backend):

No trailing slash. If it is missing, the backend logs an error at startup
and the dashboard will load but show no data. If it is set to the wrong
address there is no error in the backend log — the browser just blocks the
response — so please test in dev first.

What will break

• Any script, curl command or CI job that called these APIs without a login
  token now gets 401. It needs a token.
• Local frontend development with VITE_DISABLE_AUTH=true will get 401. We
  deliberately did not add a "skip auth" switch to the backend, because that
  is exactly the hole this PR closes.
• Health checks against components using self-signed or expired
  certificates will now fail instead of silently passing. This may reveal
  existing certificate problems in dev.

Still to do (not in this PR)

1. Any logged-in user can still see and delete every company's
   deployments. Login is now required, but there is no per-company
   separation and no read-only role. This is the biggest remaining gap and
   should be the next ticket.

2. emc-api-key, appConfig.authorization and VITE_API_KEY are now
   unused and can be deleted from the chart values.