Introduce a confidential service-account client (Option A) to replace user-based
kcadm sessions. The client is created automatically, granted realm-admin role,
and used for all subsequent Keycloak updates. Includes improved error handling
for HTTP 401 responses.
Discussion: https://chatgpt.com/share/68e01da3-39fc-800f-81be-2d0c8efd81a1
