How Keycloak realms, clients, flows and token lifetimes fit together, plus the clustering and session decisions that bite operators later.