feat(sankofa): public web CT 7806, portal NPM/DNS defaults, Keycloak redirect helper

- Provision/sync scripts and systemd for corporate Next on 7806; IP_SANKOFA_PUBLIC_WEB for apex NPM
- Portal stack: NEXTAUTH_URL default portal.sankofa.nexus; NPM fleet + migrate + DNS ordering
- keycloak-sankofa-ensure-client-redirects.sh (KEYCLOAK_ADMIN_PASSWORD); .env.master.example hints
- Docs: task list, inventory, FQDN/E2E/EXPECTED_WEB_CONTENT, AGENTS pointers

Made-with: Cursor

.env.master.example

@@ -52,6 +52,14 @@ NPMPLUS_ALLTRA_HYBX_VMID=
 IP_NPMPLUS_ALLTRA_HYBX=
 NPM_URL_MIFOS=
 
+# --- Keycloak Admin API (optional) ---
+# For scripts/deployment/keycloak-sankofa-ensure-client-redirects.sh — merge portal/admin redirect URIs.
+# KEYCLOAK_URL=https://keycloak.sankofa.nexus
+# KEYCLOAK_REALM=master
+# KEYCLOAK_CLIENT_ID=sankofa-portal
+# KEYCLOAK_ADMIN=admin
+# KEYCLOAK_ADMIN_PASSWORD=
+
 # --- Fastly ---
 FASTLY_API_TOKEN=
 
@@ -159,6 +167,8 @@ SANKOFA_PHOENIX_API_URL=
 SANKOFA_PHOENIX_CLIENT_ID=
 SANKOFA_PHOENIX_CLIENT_SECRET=
 SANKOFA_PHOENIX_TENANT_ID=
+# Corporate apex (sankofa.nexus) → CT 7806 when provisioned (default in ip-addresses stays portal until set)
+# IP_SANKOFA_PUBLIC_WEB=192.168.11.63
 
 # --- Frontend / MetaMask / Explorer ---
 VITE_WALLETCONNECT_PROJECT_ID=