MAUI project scaffold + Keycloak authentication

[fboucher]

Parent PRD

#110

Depends on

#119 (SharedUI RCL must exist to reference)

Summary

Create the NoteBookmark.MauiApp project targeting Android. Implement Keycloak OIDC login via WebAuthenticator, with token storage in SecureStorage. Wire up the MAUI shell with a single post-login placeholder page — enough to prove auth works end-to-end on a device or Waydroid.

Acceptance Criteria

• NoteBookmark.MauiApp project created, targeting Android, added to solution
• NoteBookmark.SharedUI referenced from MauiApp
• Keycloak OIDC login via WebAuthenticator works (opens system browser, handles redirect callback)
• Access token and refresh token stored in SecureStorage
• On app startup: cached tokens loaded; silent refresh attempted if online and token expired
• If offline and token not yet expired, app proceeds without re-auth
• If refresh fails while offline, user sees a clear "Session expired — go online to re-authenticate" message
• Post-login screen visible (placeholder is fine)

Auth stories from PRD

User stories 10, 11

[fboucher]

Triage: Can be closed — all acceptance criteria met by PR #131

PR #131 (eat: MAUI scaffold + Keycloak auth) delivered every acceptance criterion:

• ✅ NoteBookmark.MauiApp project created, targeting Android, added to solution
• ✅ NoteBookmark.SharedUI referenced from MauiApp
• ✅ Keycloak OIDC login via WebAuthenticator (PKCE, system browser, redirect callback)
• ✅ Access + refresh tokens stored in SecureStorage
• ✅ On startup: cached tokens loaded; silent refresh if online + expired
• ✅ Offline + valid token → app proceeds; offline + expired → clear message shown
• ✅ Post-login placeholder screen (Home.razor — 'Hello, {username}' + Sign out)

Note: We've since decided to skip Keycloak authentication in the MAUI app (device lock is sufficient for a personal Android app, and auth actively hurts the offline-first goal since expired tokens lock users out). The auth code removal will be tracked in a separate issue.

[fboucher]

Closing — all acceptance criteria delivered by PR #131.