Client Webhook

### Changed
- Upload JAR to Package Registry, version bump v2.0.3
- Release asset now links to Package Registry instead of job artifacts, so no broken download URL.
- ARTIFACT_ID resolved dynamically from pom.xml — no hardcoded names.

### Changed
- Null check and disabled clients filter added to webhook event processing

### Added

- Realm context (`realm.id`, `realm.name`, `realm.display_name`) included in every webhook payload — identifies source realm for multi-realm deployments routing events to shared endpoints
- Custom user attributes (`attributes`) included in webhook payload — schema-defined fields from Keycloak's `UserProfileProvider`; internal Keycloak attributes excluded
- `RealmDetailDTO` — new DTO carrying realm metadata

### Changed

- `KeycloakUserEventDTO` — two new fields: `attributes` (`Map<String, List<String>>`), `realm` (`RealmDetailDTO`)
- `createPayload`, `createPayloadForError`, `createPayloadFromRepresentation` — all accept and populate `RealmModel`
- `REGISTER_ERROR` events now include realm context

### Notes

- Attribute fetch fails gracefully — returns empty map and logs WARN; never throws or blocks event processing

### Breaking Changes

- **Minimum Keycloak version raised to 26.6** — `OrganizationProvider` API required; older versions incompatible
- **`user_id` no longer includes `"f:"` prefix** — strip-prefix behaviour is now applied; consumers relying on the old format must update
- **Spring Web removed** — replaced by pure `httpclient5`; any classpath dependency on Spring beans from this extension will break

### Added

- `REGISTER_ERROR`, `VERIFY_EMAIL`, `UPDATE_EMAIL`, `DELETE_ACCOUNT` event support
- Realm roles included in webhook payload
- Organization membership (`id`, `name`, `alias`) included in webhook payload
- Circuit breaker — prevents hammering failed endpoints; endpoint marked unavailable after repeated failures
- `KeycloakSessionDetails` — extracts and validates client attributes (`api.url`, `api.key`, `disable.autologin`, `trusted.proxy.count`) with explicit exceptions
- `RequestUtils` — IP extraction respecting X-Forwarded-For proxy chain; `trusted.proxy.count` client attribute controls depth
- `AppConstants` — centralises all client attribute keys and header constants
- `NoWebhookDetailException` — thrown when required client attributes are missing
- `NoUserFoundException` — thrown when user lookup fails
- `disable.autologin` client attribute — opt-in override to prevent auto-login after registration

### Changed

- HTTP client migrated from Spring `RestClient` to Apache `httpclient5` with connection pooling
- Retry strategy: 4xx errors fail fast (no retry); 5xx errors retry with exponential backoff (200 ms / 400 ms / 800 ms)
- License changed from AGPL-3.0 to Apache-2.0

---