fix(keycloak): include HTTPS port in redirect URIs and remove Dockerfile build secrets

Summary

• Redirect URI port missing: Keycloak client genie-app redirect URIs used $(env:NGINX_PUBLIC_DOMAIN) without the HTTPS port, causing invalid redirect_uri errors when accessing via a non-standard port (e.g. https://localhost:8443/callback)
• keycloak-config startup race: config-and-sleep.sh exited immediately on first failure (set -e), preventing downstream services from starting because the healthcheck never passed
• Dockerfile build secret warning: ARANGO_PASSWORD was passed as build ARG and baked into the document-repository image via ENV, triggering Docker build warnings about secrets in images

Changes

• docker-compose.yaml: Pass KC_PUBLIC_ORIGIN to keycloak-config service
• configs/keycloak/genie-realm.yaml: Replace http/https + NGINX_PUBLIC_DOMAIN with KC_PUBLIC_ORIGIN for all redirect URIs and web origins
• configs/keycloak/config-and-sleep.sh: Add inline retry loop (10 attempts, 10s delay) instead of exiting on first keycloak-config-cli failure
• components/document-repository/Dockerfile: Remove ARG ARANGO_PASSWORD / ENV ARANGO_PASSWORD — the password is already injected at runtime via docker-compose.yaml environment: directive, making the build-time ARG redundant

Test plan

• Set NGINX_HTTPS_PORT=8443 in .env, rebuild keycloak-config image, verify Keycloak accepts https://localhost:8443/callback as redirect URI
• Default NGINX_HTTPS_PORT (443, omitted from URL) — verify no regression
• Cold start (docker compose down -v && docker compose up -d) — verify keycloak-config succeeds on retry without Error status, all dependent services start
• Verify account console and account web origins still work
• Build document-repository image — verify no Docker build warnings about secrets