refactor(keycloak): remove authentik naming and switch to keycloak-only paths

backend/app/security/admin_guard.py

@@ -1,13 +1,13 @@
 from fastapi import Depends, HTTPException, status
 
 from app.core.config import get_settings
-from app.schemas.auth import AuthentikPrincipal
-from app.security.authentik_jwt import require_authenticated_principal
+from app.schemas.auth import KeycloakPrincipal
+from app.security.idp_jwt import require_authenticated_principal
 
 
 def require_admin_principal(
-    principal: AuthentikPrincipal = Depends(require_authenticated_principal),
-) -> AuthentikPrincipal:
+    principal: KeycloakPrincipal = Depends(require_authenticated_principal),
+) -> KeycloakPrincipal:
     settings = get_settings()
     required_groups = {group.lower() for group in settings.admin_required_groups}