refactor(keycloak): remove authentik naming and switch to keycloak-only paths

docs/INTERNAL_API_HANDOFF.md

@@ -111,7 +111,7 @@ Response:
   "items": [
     {
       "id": "uuid",
-      "user_sub": "authentik-uid",
+      "user_sub": "idp-uid",
       "username": "chris",
       "email": "chris@ose.tw",
       "display_name": "Chris",
@@ -128,7 +128,7 @@ Response:
 Request:
 ```json
 {
-  "user_sub": "authentik-uid",
+  "user_sub": "idp-uid",
   "username": "chris",
   "email": "chris@ose.tw",
   "display_name": "Chris",
@@ -140,7 +140,7 @@ Response:
 ```json
 {
   "id": "uuid",
-  "user_sub": "authentik-uid",
+  "user_sub": "idp-uid",
   "idp_user_id": "idp-user-id-or-uuid",
   "username": "chris",
   "email": "chris@ose.tw",
@@ -153,7 +153,7 @@ Response:
 Response:
 ```json
 {
-  "user_sub": "authentik-uid",
+  "user_sub": "idp-uid",
   "permissions": [
     {
       "scope_type": "site",
@@ -167,11 +167,11 @@ Response:
 ```
 
 ### POST `/internal/idp/users/ensure`
-（相容路徑：`/internal/authentik/users/ensure`）
+（相容路徑：`/internal/idp/users/ensure`）
 Request:
 ```json
 {
-  "user_sub": "authentik-uid",
+  "user_sub": "idp-uid",
   "email": "user@example.com",
   "username": "user1",
   "display_name": "User One",