demo: replace playground with configurable Compose setup

[proddata]

Requirement

Replace the provider-specific playground with a configurable Docker Compose example. The default stack builds PostgreSQL 18 with the validator, starts a pinned Keycloak realm, and lets a user connect through stock psql's device authorization flow. A separate Compose file accepts reviewed local configuration for an external issuer.

Changes

• Remove the old Auth0 helper, Node.js client, and playground examples.
• Add a locally bound Keycloak/PostgreSQL/psql Compose stack and a separate external-provider stack.
• Add disposable TLS certificate generation, a consented connect:postgres scope, a fixed demo audience and subject mapping, and operator instructions.
• Add a configuration consistency test to the standard verification targets.

Trust boundary and failure behavior

The demo PostgreSQL HBA permits only TLS OAuth access to demo as app_reader, with an exact issuer, required scope, and pg_ident.conf mapping. Other roles, subjects, missing scopes, and invalid tokens remain denied by the validator and PostgreSQL. The external-provider stack requires an explicit configuration directory. The public demo credentials, peer recovery rule, and generated CA are for local evaluation only.

Compatibility and operations

The old playground/ scripts and Node.js client are removed. Use docker compose up --build -d and docker compose run --rm psql for the bundled Keycloak example, or compose.external.yml for an external issuer. Existing playground state is not migrated. Reverting this commit restores the old files; docker compose down --volumes removes demo data and generated certificates when desired.

The single-file external provider configuration is a separate follow-up in #9.

Verification

• docker compose --progress=plain build certs passed on arm64 after clearing local Docker build cache.
• docker compose up --detach --no-build started Keycloak and PostgreSQL reported healthy.
• docker run --rm pg-oauth-validator-demo:pg18 ... make verify-dev passed, including strict build, component tests, and check-demo-config.
• python3 tests/demo_config_test.py, sh scripts/ci/check-source-tree.sh, and default/external Compose configuration checks passed.

The interactive device approval and successful psql login still need a manual browser check. This is a demo change, not production platform certification.