docker-compose.local.yml lacked the domain service and all three portals, and never wired
host-browser OIDC. Add them, give the BFF its Keycloak/downstream env, and pin Keycloak's issuer
to http://localhost:8180 with a dynamic backchannel so a host browser logs in on localhost:8180
while the BFF still validates in-network via keycloak:8080. Portals bind-mount a localhost:8180
config.json over the baked keycloak:8080 one.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
