feat(api): standardize REST contracts and auth

tests/unit/test_keycloak_theme_config.py

@@ -0,0 +1,19 @@
+from pathlib import Path
+
+
+THEME_SCRIPT = (
+    Path(__file__).resolve().parents[2]
+    / "infra"
+    / "docker"
+    / "keycloak"
+    / "configure-theme.sh"
+)
+
+
+def test_theme_script_clears_client_login_theme_override() -> None:
+    script = THEME_SCRIPT.read_text(encoding="utf-8")
+
+    assert "TJWATER_KEYCLOAK_CLIENT_ID" in script
+    assert "sed -n '1p'" in script
+    assert "--set attributes.login_theme=" in script
+    assert "client ${client_id} 已改为继承 realm 登录主题。" in script