Make the Keycloak transform preserve or name every policy field

keycape-to-keycloak called Transform, which passes no clients, so it wrote a
realm with an empty clients array and nothing said the service-identity contract
had not been migrated. Where clients were supplied, mapClient hardcoded
standardFlowEnabled — silently giving every client_credentials registration the
browser flow — and dropped audience, service subject, tenant, roles, lifetime,
MFA policy, secret reference and handoff URLs. Realm roles and client scopes were
emitted as empty containers.

The defect was not the missing mapping but that a dropped field and an
inapplicable one looked identical in the output.

Add -clients, reading registrations through a new config.Registrations() that
converts without resolving secrets, so migration tooling cannot load material it
has no business holding. Derive flows from the declared grants. Carry the profile
claims as protocol mappers, since Keycloak has no native concept for them, and
lifetime, handoff URLs and the secret reference as attributes — the reference,
never a value. Derive realm roles and client scopes from what is present.

Report what cannot be carried, in UnpreservedReport, kept deliberately separate
from ValidationReport: consistency with the snapshot and completeness of the
migration are different questions and one list cannot answer both. It names the
unmigrated secret, the unenforceable MFA policy, passwords and factor enrolment,
and subject continuity. An incomplete transform emits partial telemetry.

Closes the semantic-preservation half of G03; proof against a live provider is
G04 and stays open.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012WAsfsfQmDu4vcBhiMcmQp

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 867844@bnt-lap001
Assistant-Session: 3d45905e-0016-4b49-b828-231406881f7b

SCOPE.md

@@ -46,10 +46,15 @@ Keycloak interchangeability are not established.
   groups and memberships are sorted, so an unchanged directory exports
   identically. Completeness beyond users, groups and memberships — passwords and
   MFA credentials in particular — is still not covered.
-- The Keycloak CLI exports users/groups through the basic transformer and has
-  no client-list input. Library-level client mapping does not preserve the full
-  current service-identity, audience, tenant/role, MFA and lifetime contract.
-  Password and MFA credential migration is not supplied.
+- The Keycloak CLI takes a `-clients` config and migrates client registrations:
+  flows follow the declared grants, and audience, tenant, service subject and
+  roles are carried as protocol mappers with per-client lifetime, handoff URLs
+  and the secret *reference* as attributes (KEY-WP-0020). What it cannot carry it
+  names, in a report separate from the consistency check: secret values, MFA
+  policy enforcement, passwords and factor enrolment, and subject continuity —
+  Keycloak mints its own `sub`, so the LLDAP canonical ID survives only as an
+  attribute. The output is a reviewed artifact, not a proven migration; that
+  proof needs a live provider swap and is not established.
 - Snapshot validation is a limited Go rule set, not full machine-readable schema
   enforcement. The canonical YAML model and discovery metadata now match the
   runtime client-registration surface and are held there by a conformance check