feat(sso): add KEYCLOAK_CLIENT_SECRET to secrets script and backend deployment

scripts/create-secrets.sh

@@ -12,6 +12,7 @@ fi
 # --- Validate required env vars ---
 : "${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}"
 : "${JWT_SECRET_KEY:?JWT_SECRET_KEY is required}"
+: "${KEYCLOAK_CLIENT_SECRET:?KEYCLOAK_CLIENT_SECRET is required}"
 
 echo "Creating namespace '${NAMESPACE}' if it does not exist..."
 kubectl create namespace "${NAMESPACE}" --dry-run=client -o yaml | kubectl apply -f -
@@ -21,6 +22,7 @@ kubectl create secret generic shorefront-secret \
   --namespace "${NAMESPACE}" \
   --from-literal="POSTGRES_PASSWORD=${POSTGRES_PASSWORD}" \
   --from-literal="JWT_SECRET_KEY=${JWT_SECRET_KEY}" \
+  --from-literal="KEYCLOAK_CLIENT_SECRET=${KEYCLOAK_CLIENT_SECRET}" \
   --dry-run=client -o yaml | kubectl apply -f -
 
 echo "Done. Secret 'shorefront-secret' is ready in namespace '${NAMESPACE}'."