Make cmd Keycloak tests work with VPN and Docker

[linkdata]

Summary

• Detect when the test process shares Docker's host network and run Keycloak on loopback with a dynamic port, avoiding broken Docker port forwarding under Mullvad VPN. Keep bridge networking for VM and rootless Docker.
• Retry observed Keycloak port collisions and clean up probe and failed-start containers explicitly.
• Pin the Keycloak test image to a multiarch digest and exercise both network paths in CI.

Verification

• cd cmd && go test -count=1 -timeout=5m ./... passed with Mullvad VPN active.
• cd cmd && golangci-lint run ./... reported 0 issues.
• git diff --check passed.
• Independent Claude review with Caveman and Ponytail found no remaining actionable issues.

The new CI step tests bridge networking; bridge forwarding remains unavailable on this VPN-connected machine.