Writing

• A provisioned Keycloak client inherits no PKCE pin, and the obvious fix is inert