Review: Fix TLS cert for dev.intelligentstaffingsystems.ai + deploy register.ftl to Keycloak configmap

Verdict: APPROVED

Template Completeness

• [x] Type — present (Bug, matches board label type:bug)
• [x] Lineage — present (blocks #86, #79, #59)
• [x] Repo — present (ldraney/pal-e-platform — correct)
• [ ] What Broke — MISSING (bug template section; "Context" section covers this with MORE detail)
• [ ] Repro Steps — MISSING (bug template section; Context provides root cause directly)
• [ ] Expected Behavior — MISSING (bug template section; implied by AC)
• [ ] Environment — MISSING (bug template section; prod cluster details in Context)
• [x] Context — present (feature template section, effectively replaces What Broke + Environment with superior detail)
• [x] User Story — present
• [x] File Targets — present (CORRECTED from previous review)
• [x] Acceptance Criteria — present (3 clear, testable criteria)
• [x] Constraints — present (includes source file location and deployment notes)
• [x] Test Expectations — present
• [x] Related — present

Traceability

• [x] story:project-setup label — verified in project-iss user-stories section (Key: project-setup, Backing: README + docs/architecture.md + docs/adoption-plan.md, Role: Developer)
• [ ] arch:infra — arch note MISSING — [SCOPE] Create architecture note arch-infra (systemic gap, non-blocking)
• [ ] arch:auth — arch note MISSING — [SCOPE] Create architecture note arch-auth (systemic gap, non-blocking)
• [x] Forgejo issue — https://forgejo.tail5b443a.ts.net/ldraney/intelligentstaffingsystems/issues/98, open

File Targets

• [x] pal-e-platform/terraform/modules/keycloak/main.tf (lines 77-88) — verified by previous review: configmap resource exists with login.css, logo.svg, theme.properties entries
• [x] pal-e-platform/salt/pillar/caddy.sls — verified by previous review: contains domain: dev.intelligentstaffingsystems.ai
• [x] Source: intelligentstaffingsystems/keycloak-theme/iss/login/register.ftl — verified: FreeMarker template with phone field (user.attributes.phone)
• [x] Source: intelligentstaffingsystems/keycloak-theme/iss/login/resources/css/register.css — verified: phone input styling for registration page
• [x] "Files agent should NOT touch" section correctly excludes ISS Rails app, pal-e-deployments, and DNS records

Repo Placement

Dependencies

• Blocks validation of #86 (dev environment) — board item 1876, validation column
• Blocks validation of #79 (dev domain DNS/Caddy) — board item 1870, validation column
• Blocks validation of #59 (registration flow) — board item 1831, validation column
• Related completed work: #17 (Keycloak login theme), platform#541 (deploy ISS theme), svc#184 (realm config) — all in done column

Acceptance Criteria

• curl -v https://dev.intelligentstaffingsystems.ai — TLS handshake + HTTP 200
• Registration page renders ISS-branded form with phone field — verifiable via browser or curl to Keycloak URL
• kubectl get configmap keycloak-iss-theme -n keycloak -o yaml — shows register.ftl content

Blast Radius

• Caddy TLS: scoped to dev.intelligentstaffingsystems.ai only. Production domain and other vhosts unaffected.
• Configmap: adding register.ftl/register.css to existing ISS theme configmap. Login page theme unaffected (login.css, logo.svg, theme.properties remain unchanged).
• Keycloak theme cache disabled — configmap update takes effect without pod restart.
• No downstream consumers beyond the three blocked validation tickets.

Decomposition Assessment

Recommendations

• [SCOPE] Create architecture note arch-infra for component infra (systemic gap — non-blocking for execution)
• [SCOPE] Create architecture note arch-auth for component auth (systemic gap — non-blocking for execution)