OIDC-backed sign-in and API integration are not wired in this scaffold. Use the same Keycloak patterns as Sankofa portal where a shared IdP is appropriate.