Build workforce-api REST + MCP layers (Layer 3), full build in one pass

16 routes: Office (single key, full CRUD + employees sub-resource)
and Employee (single key, full CRUD + reports + customers
sub-resources). MCP layer built with the single-route pattern from
the start.

Only domain where customer role has zero access — verified against
ReferenceDataPermission.check(): read_only/product_manager/support
get reads, writes are admin-only, customer isn't in the allow-list
at all. All 9 MCP tool ACLs reflect this exactly.

Keycloak (local): workforce-api-audience + mcp-workforce-audience
client scopes, resource clients, broker/librechat attachments.
Deploy key and broker secret reused/mirrored, same pattern as every
domain since payments-api.

kong/mcp/openid-connect.yaml

@@ -0,0 +1,27 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-workforce-mcp-openid-connect
+  namespace: ${NAMESPACE}
+plugin: openid-connect
+config:
+  issuer: ${OIDC_ISSUER}
+  audience_required: ${API_AUDIENCE}
+  auth_methods:
+    - bearer
+  display_errors: false
+  ssl_verify: true
+  consumer_groups_claim:
+    - realm_access
+    - roles
+  client_id:
+    - ${TOKEN_EXCHANGE_CLIENT_ID}
+  client_secret:
+    - ${TOKEN_EXCHANGE_CLIENT_SECRET}
+  token_exchange:
+    subject_token_issuers:
+      - issuer: ${OIDC_ISSUER}
+        conditions: {}
+    request:
+      audience: ${API_AUDIENCE}
+      scopes: []