Stateless Keycloak for Laravel: an auth guard verifying realm access tokens with firebase/php-jwt (JWKS with key rotation, iss/aud/exp/typ), per-realm and per-client user resolution, a role middleware, a client and service tokens, a backend-for-frontend browser login kept in cookies, and a signing test fake. No server-side session.