refactor: remove ALLOWED_MCP_CLOUD_CLIENTS and add keycloak CI profile

Remove the unused ALLOWED_MCP_CLOUD_CLIENTS env var — all clients are
defined via ALLOWED_MCP_CLIENTS or the static well-known defaults.
Add keycloak as an integration test profile in CI now that login-flow
replaces the old bearer token approach for external IdPs.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tests/unit/test_client_registry.py

@@ -23,7 +23,6 @@ def _get_registry(monkeypatch, value: str | None = None):
         monkeypatch.setenv("ALLOWED_MCP_CLIENTS", value)
     else:
         monkeypatch.delenv("ALLOWED_MCP_CLIENTS", raising=False)
-    monkeypatch.delenv("ALLOWED_MCP_CLOUD_CLIENTS", raising=False)
     return registry_mod.get_client_registry()
 
 
@@ -162,15 +161,6 @@ def test_well_known_clients_wildcard_scopes(monkeypatch):
         )
 
 
-def test_deprecated_cloud_clients_warning(monkeypatch, caplog):
-    monkeypatch.setenv("ALLOWED_MCP_CLOUD_CLIENTS", "old|https://old.com/cb")
-    monkeypatch.setenv("ALLOWED_MCP_CLIENTS", "new-client")
-    with caplog.at_level(logging.WARNING):
-        registry_mod.get_client_registry()
-
-    assert "ALLOWED_MCP_CLOUD_CLIENTS is deprecated" in caplog.text
-
-
 def test_client_name_resolution(monkeypatch):
     registry = _get_registry(monkeypatch, "claude-desktop, custom-tool")
     assert registry.get_client("claude-desktop").name == "Claude Desktop"