MAUI project scaffold + Keycloak authentication

[fboucher]

Parent PRD

#110

Depends on

#119 (SharedUI RCL must exist to reference)

Summary

Create the NoteBookmark.MauiApp project targeting Android. Implement Keycloak OIDC login via WebAuthenticator, with token storage in SecureStorage. Wire up the MAUI shell with a single post-login placeholder page — enough to prove auth works end-to-end on a device or Waydroid.

Acceptance Criteria

• NoteBookmark.MauiApp project created, targeting Android, added to solution
• NoteBookmark.SharedUI referenced from MauiApp
• Keycloak OIDC login via WebAuthenticator works (opens system browser, handles redirect callback)
• Access token and refresh token stored in SecureStorage
• On app startup: cached tokens loaded; silent refresh attempted if online and token expired
• If offline and token not yet expired, app proceeds without re-auth
• If refresh fails while offline, user sees a clear "Session expired — go online to re-authenticate" message
• Post-login screen visible (placeholder is fine)

Auth stories from PRD

User stories 10, 11