docs: add infrastructure guide for JWT in Docker and refactor Keycloak config

Added a detailed guide (`jwt-in-docker.md`) to address JWT validation challenges in Docker environments (Split Horizon issue). Refactored Keycloak realm configuration (`meldestelle-realm.json`) with updated roles, clients, and improved infrastructure clarity. Updated `.env` variables for streamlined token validation. Adjusted Docker Compose services (`dc-backend.yaml`) to use revised Keycloak environment variables.

.env

@@ -44,6 +44,12 @@ KC_HOSTNAME=localhost
 KC_PORT=8180:8080
 KC_DEBUG_PORT=9000:9000
 
+# --- KEYCLOAK TOKEN VALIDATION ---
+# Public Issuer URI (must match the token issuer from browser/postman)
+KC_ISSUER_URI=http://localhost:8180/realms/meldestelle
+# Internal JWK Set URI (for service-to-service communication within Docker)
+KC_JWK_SET_URI=http://keycloak:8080/realms/meldestelle/protocol/openid-connect/certs
+
 # --- PGADMIN ---
 PGADMIN_IMAGE=dpage/pgadmin4:8
 PGADMIN_EMAIL=meldestelle@mo-code.at
@@ -83,8 +89,6 @@ GATEWAY_SERVER_PORT=8081
 GATEWAY_SPRING_PROFILES_ACTIVE=docker
 GATEWAY_DEBUG=true
 GATEWAY_SERVICE_NAME=api-gateway
-SSEC_ISSUER_URI=http://keycloak:8080/realms/meldestelle
-SSEC_JWK_SET_URI=http://keycloak:8080/realms/meldestelle/protocol/openid-connect/certs
 GATEWAY_CONSUL_HOSTNAME=api-gateway
 GATEWAY_CONSUL_PREFER_IP=true