Broker a partner's OIDC identity provider as a plain login button — via the Keycloak MCP server

Broker a partner company's own OIDC identity provider into a Phase Two hosted Keycloak realm as a plain "log in with <partner>" button - driven through the Keycloak MCP server. Use this whenever someone asks to "let our partner's staff log in with their own account", "add a login-with-X button", "federate a partner's identity provider", or "broker an external OIDC provider" - with NO organization membership requirement and NO domain-based auto-routing attached. Covers createOidcIdp, mapping claims onto the brokered user with addIdpAttributeMapper, and verifying with more than one real user so no hidden per-user gate slips in. Not admin:org-restrict-login / admin:idp-org-r…