feat(wallets): bind a legacy wallet to a keycloak account

[samwel141]

Closes #1241

Problem

Wallets created before Keycloak carry no keycloak_account_id, and the panel had no way to set one. The issue also asked us to define how an admin finds that id before coding; we agreed on search rather than pasting a uuid, since a pasted id is unverifiable and the acceptance criteria already ask the page to show the account's name or email.

Change

A wallet detail page at /wallets/:walletId, reached by clicking a wallet name in the list. It shows the name, the keycloak id (empty when unbound) and, once bound, the account behind it. A "Bind keycloak account" button opens a dialog that searches by email or username, lists the matches, and binds the one the admin picks.

The route sits behind the same wallet-admin gate as the Wallets page, so /wallets/:id renders Unauthorized for anyone else.

Verification

4 unit tests in src/views/WalletDetailView.test.js cover the unbound state, the bound state with account info, the full search-and-bind flow, and a load failure. 202 unit tests pass, eslint and prettier clean, production build succeeds.

The BDD scenario was run against a local wallet-api on the Greenstand/treetracker-wallet-api#612 branch, so the detail page and the empty keycloak id are verified against the real endpoints:

✓ And I click the name of the wallet "wallet-legacy-01"
✓ Then I should see the wallet detail page for "wallet-legacy-01"
✓ And the keycloak id is empty
✓ When I open the bind keycloak account dialog
✖ And I search for a keycloak account and pick the first match

Video in reports/video/wallet-admin/run.mp4.

Blocker

The scenario's last two steps stay red until the APIs they call are merged and deployed to dev:

• the search step needs feat(keycloak): search accounts by email or username treetracker-admin-api#678
• the final assertion needs feat(admin): bind a keycloak account to an existing wallet treetracker-wallet-api#612