Part of the epic pyronear/roadmap#23 (Keycloak).

Context & objective

Depends on #698 (Keycloak user authentication). Once users are on Keycloak, cameras are the last clients using API-issued JWTs.
Goal: Keycloak becomes the only token issuer. The API only verifies tokens and no longer issues any.

What is done currently

• An admin creates a camera token via POST /cameras/{id}/token: API-signed JWT (JWT_SECRET), camera scope, valid 1 year.
• pyro-engine stores one static token per camera and passes it to pyroclient. There is no login and no refresh.
• No way to revoke a single camera token.

What has to be done

• Keycloak: one confidential client per camera (client credentials flow), with a camera role and claims camera_id + organization_id.
• API: remove create_access_token, JWT_SECRET / JWT_* settings, POST /cameras/{id}/token and the API-issuer path in get_jwt. Keycloak token verification is the only path left.
• pyroclient: authenticate with client_id / client_secret, cache the token and refresh it before expiry (and on 401).
• pyro-engine: switch the credentials from a token to client_id / client_secret (companion issue in pyro-engine).
• Throwaway script to create the Keycloak clients for existing cameras.

Technical considerations

• Field connectivity is intermittent (4G): use a reasonably long token lifetime, and make sure a failed refresh doesn't block local detection (retry, keep queueing).
• Rollout: optin to discuss : devices are updated progressively, so the API has to accept both issuers until the whole fleet is migrated. Only then remove the legacy path.
• Provisioning a new camera = creating the camera in the API + its client in Keycloak. Manual for now, to be automated later.
• Dev & e2e: pyro-envdev Keycloak (feat: add service keycloak pyro-envdev#45), with a realm containing test camera clients.