feat(local-identity): Stage 2 — Keycloak export & bootstrap integration (NK-WP-0002-T02)

export.py:
  - split_fullname(): last-token strategy (Bernd Worsch → firstName/lastName)
  - _deterministic_id(): uuid5(DNS, "local-identity.{realm}.{username}") for stable,
    re-import-idempotent Keycloak IDs
  - user_to_keycloak(): full Keycloak Admin REST API user representation;
    production_identity mapping applied to username + realm; isolation attributes
    (local_identity_environment, local_identity_generated) always present;
    validate_keycloak_user() called on every conversion to catch schema drift
  - bulk_export_body(): partial import body (ifResourceExists/realm/users)

cli.py: add `export` subcommand
  - export <username>         single user, prints Keycloak JSON
  - export (no args)          bulk; primary users only; stderr note on skipped test users
  - export --include-test     bulk; all users including generated
  - --realm / --if-resource-exists flags

docs/LocalIdentity.md: add two new sections
  - Keycloak import procedure: export → partialImport API → password reset → retire
  - Isolation guarantee: attribute schema, Keycloak Condition authenticator config,
    production_identity mapping walkthrough

tests/test_export.py: 34 new tests (88 total, all passing)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

workplans/NK-WP-0002-local-identity.md

@@ -108,8 +108,9 @@ unit tests passing.
 ```task
 id: NK-WP-0002-T02
 state_hub_task_id: 5ea6e68d-7ebe-4ea7-b92e-61aac17ff04c
-status: todo
+status: done
 priority: high
+commit: c TBD
 ```
 
 Extend user schema with optional `production_identity` block (`username`,
@@ -223,7 +224,7 @@ expiry and revocation functional.
 ## Deliverables Checklist
 
 - [x] `~/.local-identity/` store initialised from Linux identity; test users generated
-- [ ] `local-identity list / show / export` working; Keycloak export validated
+- [x] `local-identity list / show / export` working; Keycloak export validated
 - [ ] Minimal OIDC server passes conformance smoke test; binds localhost only
 - [ ] Filesystem permissions enforced on startup; `security-check` passes
 - [ ] Audit log recording all auth events