OPC # 0002: Improvements to Client provisioning workflows

ControlPlane.Worker/Services/KeycloakAdminClient.cs

@@ -28,6 +28,28 @@ public class KeycloakAdminClient
         _http = new HttpClient { BaseAddress = new Uri(_baseUrl) };
     }
 
+    /// <summary>
+    /// Creates a KeycloakAdminClient for a specific base URL and credentials.
+    /// Used by KeycloakStep to target SharedPlatform or OwnContainer Keycloak instances
+    /// using the resolved topology rather than static DI configuration.
+    /// </summary>
+    public static KeycloakAdminClient ForUrl(
+        string adminUrl, string adminUser, string adminPassword,
+        ILogger<KeycloakAdminClient> logger)
+        => new(adminUrl, adminUser, adminPassword, logger);
+
+    private KeycloakAdminClient(
+        string adminUrl, string adminUser, string adminPassword,
+        ILogger<KeycloakAdminClient> logger)
+    {
+        _logger   = logger;
+        _baseUrl  = adminUrl.TrimEnd('/');
+        _adminUser    = adminUser;
+        _adminPassword = adminPassword;
+        _logger.LogInformation("KeycloakAdminClient base URL: {Url}, user: {User}", _baseUrl, _adminUser);
+        _http = new HttpClient { BaseAddress = new Uri(_baseUrl) };
+    }
+
     private async Task AuthorizeAsync(CancellationToken ct)
     {
         var form = new FormUrlEncodedContent(new Dictionary<string, string>