Refactor app instance to Keycloak SSO

AGENTS.md

@@ -1,4 +1,12 @@
-<!-- SPECKIT START -->
-For additional context about technologies to be used, project structure,
-shell commands, and other important information, read the current plan
-<!-- SPECKIT END -->
+# Repository Instructions
+
+This branch is scoped to the standalone `app-instance` package.
+
+Useful entry points:
+
+- `app-instance/README.md`
+- `app-instance/run-standalone.sh`
+- `app-instance/backend`
+- `app-instance/frontend`
+
+The repository no longer owns the old auth portal, authz service, deploy control plane, router proxy, or per-user instance orchestration.