Add user authentication and dynamic feature/category inputs

Implement Keycloak authentication, protected routes, and add combobox and autocomplete components for tool categories and features.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 776963d0-f75d-42e2-a57b-cc36bdff8495
Replit-Commit-Checkpoint-Type: full_checkpoint
Replit-Commit-Event-Id: 0b145113-c016-4f54-b000-13bd3b0ba8f0
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/0683fb79-a27c-485c-9333-5f4b288c4567/776963d0-f75d-42e2-a57b-cc36bdff8495/z4uWN6A
Replit-Helium-Checkpoint-Created: true

lib/api-spec/openapi.yaml

@@ -304,6 +304,40 @@ paths:
                 items:
                   type: string
 
+  /features/all:
+    get:
+      operationId: listAllFeatures
+      tags: [tools]
+      summary: List all distinct feature strings across all tools
+      responses:
+        "200":
+          description: All known features
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  type: string
+
+  /auth/me:
+    get:
+      operationId: getMe
+      tags: [auth]
+      summary: Get current authenticated user
+      responses:
+        "200":
+          description: Current user info
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AuthUser"
+        "401":
+          description: Not authenticated
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ErrorResponse"
+
 components:
   schemas:
     HealthStatus:
@@ -533,6 +567,19 @@ components:
         count:
           type: integer
 
+    AuthUser:
+      type: object
+      required: [sub]
+      properties:
+        sub:
+          type: string
+        email:
+          type: ["string", "null"]
+        name:
+          type: ["string", "null"]
+        preferredUsername:
+          type: ["string", "null"]
+
     ErrorResponse:
       type: object
       required: [error]