feat(web-app-drupal): add Drupal role, OIDC config, and wiring

- networks: add web-app-drupal subnet 192.168.104.80/28
- ports: map localhost http port 8060
- add role files: tasks, vars, schema, users, templates (Dockerfile, docker-compose, settings.local.php, upload.ini)
- add docs: README.md and Administration.md

Ref: https://chatgpt.com/share/690535c5-b55c-800f-8556-5335a6b8a33f

roles/web-app-drupal/vars/main.yml

@@ -0,0 +1,28 @@
+# General
+
+application_id:               "web-app-drupal"
+database_type:                "mariadb"
+
+# Drupal
+
+DRUPAL_URL:                   "{{ domains | get_url(application_id, WEB_PROTOCOL) }}"
+DRUPAL_CUSTOM_IMAGE:          "drupal_custom"
+DRUPAL_DOCKER_HTML_PATH:      "/var/www/html"
+DRUPAL_DOCKER_CONF_PATH:      "/var/www/html/sites/default"
+DRUPAL_VERSION:               "{{ applications | get_app_conf(application_id, 'docker.services.drupal.version') }}"
+DRUPAL_IMAGE:                 "{{ applications | get_app_conf(application_id, 'docker.services.drupal.image') }}"
+DRUPAL_CONTAINER:             "{{ applications | get_app_conf(application_id, 'docker.services.drupal.name') }}"
+DRUPAL_VOLUME:                "{{ applications | get_app_conf(application_id, 'docker.volumes.data') }}"
+DRUPAL_DOMAINS:               "{{ applications | get_app_conf(application_id, 'server.domains.canonical') }}"
+DRUPAL_USER:                  "www-data"
+
+DRUPAL_CONFIG_UPLOAD_REL:     "config/upload.ini"
+DRUPAL_CONFIG_UPLOAD_ABS:     "{{ [docker_compose.directories.instance, DRUPAL_CONFIG_UPLOAD_REL] | path_join }}"
+
+DRUPAL_SETTINGS_LOCAL_REL:    "config/settings.local.php"
+DRUPAL_SETTINGS_LOCAL_ABS:    "{{ [docker_compose.directories.instance, DRUPAL_SETTINGS_LOCAL_REL] | path_join }}"
+
+DRUPAL_MSMTP_SRC:             "{{ [ playbook_dir, 'roles/sys-svc-msmtp/templates/msmtprc.conf.j2' ] | path_join }}"
+DRUPAL_MSMTP_ABS:             "{{ [ docker_compose.directories.config, 'msmtprc.conf'] | path_join }}"
+
+DRUPAL_MAX_UPLOAD_SIZE:       "{{ applications | get_app_conf(application_id, 'max_upload_size') }}"

roles/web-app-drupal/vars/oidc.yml

@@ -0,0 +1,33 @@
+# OIDC configuration for Drupal's OpenID Connect module.
+
+# Global settings for openid_connect.settings
+
+oidc_settings:
+  automatic_account_creation:        true        # Auto-create users on first login
+  always_save_userinfo:              true        # Store latest userinfo on each login
+  link_existing_users:               true        # Match existing users by email
+  login_display:                     "button"    # 'button' or 'form'
+  enforced:                          false       # If true, require login for the whole site
+
+# OIDC client entity (e.g., 'keycloak')
+
+oidc_client:
+  id:                                "keycloak"
+  label:                             "Keycloak"
+  settings:
+    client_id:                       "{{ OIDC.CLIENT.ID }}"
+    client_secret:                   "{{ OIDC.CLIENT.SECRET }}"
+    authorization_endpoint:          "{{ OIDC.CLIENT.AUTHORIZE_URL }}"
+    token_endpoint:                  "{{ OIDC.CLIENT.TOKEN_URL }}"
+    userinfo_endpoint:               "{{ OIDC.CLIENT.USER_INFO_URL }}"
+    end_session_endpoint:            "{{ OIDC.CLIENT.LOGOUT_URL }}"
+    scopes:
+      - "openid"
+      - "email"
+      - "profile"
+    use_standard_claims:             true
+# Optional claim mapping examples:
+# username_claim:                "{{ OIDC.ATTRIBUTES.USERNAME }}"
+# email_claim:                   "{{ OIDC.ATTRIBUTES.EMAIL }}"
+# given_name_claim:              "{{ OIDC.ATTRIBUTES.GIVEN_NAME }}"
+# family_name_claim:             "{{ OIDC.ATTRIBUTES.FAMILY_NAME }}"