fix(ansible): validate and expose mobile Keycloak client variables

Problem

KC_MOBILE_CLIENT_ID and KC_MOBILE_REDIRECT_SCHEME are used by keycloak-config-cli via $(env:KC_MOBILE_CLIENT_ID) in configs/keycloak/genie-realm.yaml, but:

1. They were never included in the Ansible env.j2 template → absent from the generated .env
2. They had no validation in deploy.yml → deploy silently succeeds with empty values
3. Result: mobile OIDC client created with empty clientId and broken redirectUris

Changes

• Add kc_mobile_client_id and kc_mobile_redirect_scheme to the assert validation in deploy.yml
• Add them to templates/env.j2 (no defaults — mandatory)

Test plan

• ansible-playbook --syntax-check deploy.yml passes
• Deploy fails with clear error if kc_mobile_client_id or kc_mobile_redirect_scheme are missing from vault
• Deploy succeeds when both are provided
• Generated .env contains both variables