refactor(keycloak): remove authentik naming and switch to keycloak-only paths

backend/tests/test_internal_idp_sync.py

@@ -0,0 +1,23 @@
+from fastapi.testclient import TestClient
+
+from app.main import app
+from app.security.api_client_auth import require_api_client
+
+
+def test_internal_idp_ensure_requires_config() -> None:
+    app.dependency_overrides[require_api_client] = lambda: None
+    client = TestClient(app)
+    try:
+        resp = client.post(
+            "/internal/idp/users/ensure",
+            json={
+                "sub": "idp-sub-1",
+                "email": "user@example.com",
+                "display_name": "User Example",
+                "is_active": True,
+            },
+        )
+        assert resp.status_code == 503
+        assert resp.json()["detail"] == "idp_admin_not_configured"
+    finally:
+        app.dependency_overrides.pop(require_api_client, None)