Send traces to Tempo and expose metrics to Prometheus

Point the OTel Java agent at Tempo instead of Jaeger, so Keycloak's traces
land in the same backend as the rest of the stack and correlate with the
Loki logs of the same requests.

Annotate the pod for scraping. KC_METRICS_ENABLED already served /metrics
on the management port, so this only makes Prometheus discover it — on
port 9000, never on the application port.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

k8s/keycloak/deployment.yaml

@@ -19,6 +19,13 @@ spec:
         app.kubernetes.io/name: keycloak
         app.kubernetes.io/component: idp
         app.kubernetes.io/part-of: keycloak
+      annotations:
+        # Discovered by the Prometheus in the observability namespace.
+        # Endpoint exposed by KC_METRICS_ENABLED=true, on the management
+        # port (9000), never on the application port.
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "9000"
+        prometheus.io/path: "/metrics"
     spec:
       initContainers:
         - name: download-otel-agent
@@ -102,7 +109,7 @@ spec:
             - name: OTEL_SERVICE_NAME
               value: "keycloak"
             - name: OTEL_EXPORTER_OTLP_ENDPOINT
-              value: "http://jaeger.observability.svc.cluster.local:4318"
+              value: "http://tempo.observability.svc.cluster.local:4318"
             - name: OTEL_EXPORTER_OTLP_PROTOCOL
               value: "http/protobuf"
             - name: OTEL_TRACES_EXPORTER