Per-domain directories: a refused token counts toward the sign-in ban, and tests 10 and 18 (DIR-12, DIR-30)

A token the OIDC directory rejects is an authentication failure, so it
counts toward the ban; a network, provider or configuration fault stays
an error and doesn't. Before, a rejected token was an error too, so bad
tokens never led to a ban.

The Keycloak container now imports a second realm, so test 10 checks
/api/discover and the PACC record answer with each domain's own provider.
Test 18 checks that eight sign-ins during an outage don't ban the client,
while bad tokens do.

tests/src/utils/containers.rs

@@ -307,6 +307,11 @@ pub async fn ensure_keycloak() {
                     "/opt/keycloak/data/import/stalwart-realm.json",
                     include_bytes!("../../docker/keycloak/stalwart-realm.json").to_vec(),
                 )
+                // inbuxa: a second provider, for per-domain directories (test 10)
+                .with_copy_to(
+                    "/opt/keycloak/data/import/inbuxa-realm.json",
+                    include_bytes!("../../docker/keycloak/inbuxa-realm.json").to_vec(),
+                )
                 .with_mapped_port(9080, 9080.tcp())
                 .with_startup_timeout(READY_TIMEOUT)
                 .with_container_name("stalwart-test-keycloak")
@@ -317,6 +322,7 @@ pub async fn ensure_keycloak() {
         })
         .await;
     wait_for_http("http://localhost:9080/realms/stalwart/.well-known/openid-configuration").await;
+    wait_for_http("http://localhost:9080/realms/inbuxa/.well-known/openid-configuration").await;
 }
 
 pub async fn ensure_scim_tester() -> &'static ContainerAsync<GenericImage> {