# TASK 3.2: Add backend authenticated user context and admin user-management integration

## Summary

Add backend endpoints and services that let Laravel obtain current-user context and perform user-management flows through Keycloak integration rather than local user tables.

## Dependencies

- TASK 1.1 complete
- TASK 1.2 complete
- TASK 2.1 complete

## Files to Modify

Likely files:

- `backend/Kds.Ai.ApiService/Program.cs`
- new endpoint files under `backend/Kds.Ai.ApiService/Endpoints`
- new Keycloak integration service files under backend projects

## Required Behavior

The backend must provide:

- a current-user context endpoint such as `me`,
- caller role and tenant/customer context needed by Laravel views and BFF flows,
- admin-facing user list/create/update/disable operations backed by Keycloak Admin APIs and backend membership data.

The user-management flow should not recreate a local backend password store.

## Acceptance Criteria

- [ ] Backend exposes authenticated current-user context
- [ ] Laravel can obtain tenant/customer context without local DB lookups
- [ ] Admin user-management operations integrate with Keycloak, not local user tables
- [ ] Backend coordinates Keycloak user data with app-owned membership data where necessary

## Notes

- Keep identity and app data ownership separate even when one endpoint combines them for UI convenience.