Remove the unused ALLOWED_MCP_CLOUD_CLIENTS env var — all clients are defined via ALLOWED_MCP_CLIENTS or the static well-known defaults. Add keycloak as an integration test profile in CI now that login-flow replaces the old bearer token approach for external IdPs. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>