ci: run the auth tests on a schedule, and badge them

[saqibmanan]

Adds the tests badge — and the workflow that makes it mean something.

Why a badge was not possible before

The Keycloak tests run as a job inside the deploy workflow via workflow_call, and a reusable workflow's runs are recorded against the caller. So keycloak-tests.yml has no run history of its own. A shields badge pointed at it renders:

auth tests: repo or workflow not found

The real reason to add this

Not the badge. The post-deploy tests only prove the theme was healthy at the moment it shipped.

auth.civicdatalab.in can break with no deploy involved:

• a client or realm setting changed in the admin console
• a certificate expiring
• Google rotating an identity-provider credential
• the box filling its disk

None of that touches this repository, so nothing would notice until the next theme change — potentially weeks, on the server every CivicDataLab product authenticates through.

What it does

Runs the same checks every 6 hours — often enough to catch a break the same working day, rare enough not to be noise. Deploys nothing, read-only against the live server, and passes api_base_url so the health assertion runs rather than skipping.

Also manually runnable via workflow_dispatch, which works here because the file lands on the default branch.

Badge

deploy: passing   ci: passing   auth tests: …   deploys to: auth.civicdatalab.in

It will read no status until the first scheduled run, then reflect real state.

Verified separately

#24's paths-ignore is confirmed working: merging #25 (docs-only) ran ci but no deploy, while #24 (workflow change) ran both.