keycloak: port to Go and repair an admin that refuses the mesh's secret

Twice the identity provider's admin kept an older password than the one the
mesh minted (an adopted, then a moved database), and the provisioner failed
every consumer until it was repaired by hand (hq issue 179). The module now
checks the admin's login and repairs a refusal itself through the server's
bootstrap command, verifies, brakes a failed repair and announces it, and
stops asking the server while refused. Ported to Go to change it.

modules/keycloak/module.json

@@ -36,7 +36,9 @@
     "password.reset",
     "client.created",
     "group.created",
-    "role.created"
+    "role.created",
+    "admin.repaired",
+    "admin.unrepaired"
   ],
   "listens": [
     {
@@ -150,22 +152,19 @@
       {
         "name": "code",
         "kind": "bundle",
-        "language": "typescript",
-        "entrypoints": [
-          "index.js",
-          "tools/index.js",
-          "provisioner/index.js"
-        ],
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/keycloak-provider",
+        "binary": "keycloak-provider",
         "loads": [
-          "index.js",
-          "tools/index.js",
-          "provisioner/index.js"
+          "keycloak-provider"
         ],
         "env": {
           "MESH_KEYCLOAK_URL": "http://127.0.0.1:${port:8080}",
           "MESH_KEYCLOAK_CONFIG_FILE": "${dir:mesh-state}/config.json",
           "MESH_KEYCLOAK_PASSWORD_FILE": "${dir:state}/admin.secret",
-          "MESH_RECEIVES": "${dir:grants}/mesh.json"
+          "MESH_RECEIVES": "${dir:grants}/mesh.json",
+          "MESH_KEYCLOAK_CONTAINER": "keycloak"
         }
       }
     ]