fix: support https test setup across keycloak versions (#715)

[tiborrr]

Summary

• add HTTPS-capable Keycloak test startup with self-signed cert support and sensible default env values in test_keycloak_init.sh
• make test fixtures and Keycloak client setup scheme-aware (http/https) via tests/conftest.py
• update integration test assertions to handle version-specific Keycloak error payload differences (notably on newer versions)

Why

Newer Keycloak versions changed HTTPS/token/error behavior, which caused the integration suite to fail under the previous HTTP-only assumptions.
These changes keep tests stable across supported Keycloak versions while preserving the existing test flow and maintainability.

What Changed

• test_keycloak_init.sh
  • defaults for KEYCLOAK_ADMIN, KEYCLOAK_ADMIN_PASSWORD, KEYCLOAK_HOST, KEYCLOAK_PORT
  • optional HTTPS mode (default enabled) with generated self-signed certs
  • HTTPS/HTTP-aware port mapping and readiness check
  • exported env vars for downstream pytest process consistency
• tests/conftest.py
  • KeycloakTestEnv now exposes scheme, server_url, verify, use_https
  • fixtures use env.server_url and verify=env.verify
• tests/test_keycloak_admin.py, tests/test_keycloak_openid.py, tests/test_keycloak_uma.py, tests/test_pkce_flow.py
  • adjusted hardcoded http://... expectations to scheme-aware expectations
  • made assertions resilient to equivalent Keycloak error variants across versions
  • handled post-logout invalid token behavior differences where applicable

Validation

• full suite passes locally:
  • ./test_keycloak_init.sh "uv run python -m pytest -q"
  • result: 210 passed
• lint/format checks pass (ruff check and ruff format --check)
• compatibility spot checks passed on:
  • Keycloak 22.0
  • Keycloak 23.0
  • Keycloak 26.6.1 / latest

Linked Issue

• Closes Fix test compatibility with latest Keycloak (HTTPS + response changes) #715

[tiborrr]

Note

I am doing this to get started on #669 to migrate to httpx also for the sync part of the code.