feat: establish reusable CoreLink Identity theme foundation

.dockerignore

@@ -0,0 +1,6 @@
+node_modules
+dist
+dist_keycloak
+.git
+.github
+README.md

.github/workflows/ci.yml

@@ -0,0 +1,73 @@
+name: Identity CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: identity-ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build-theme:
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v7.0.1
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 20
+
+      - name: Use pre-installed Temurin JDK 17
+        run: echo "JAVA_HOME=$JAVA_HOME_17_X64" >> "$GITHUB_ENV"
+
+      - name: Install dependencies
+        id: install
+        continue-on-error: true
+        run: |
+          set -o pipefail
+          npm install 2>&1 | tee ci-install.log
+
+      - name: Typecheck and web build
+        id: check
+        if: steps.install.outcome == 'success'
+        continue-on-error: true
+        run: |
+          set -o pipefail
+          npm run check 2>&1 | tee ci-check.log
+
+      - name: Build Keycloak theme
+        id: theme
+        if: steps.install.outcome == 'success' && steps.check.outcome == 'success'
+        continue-on-error: true
+        run: |
+          set -o pipefail
+          npm run build:keycloak 2>&1 | tee ci-theme.log
+
+      - name: Upload diagnostics
+        if: always()
+        uses: actions/upload-artifact@v7.0.1
+        with:
+          name: identity-ci-diagnostics
+          path: |
+            ci-install.log
+            ci-check.log
+            ci-theme.log
+          if-no-files-found: ignore
+
+      - name: Upload theme JAR
+        if: steps.theme.outcome == 'success'
+        uses: actions/upload-artifact@v7.0.1
+        with:
+          name: corelink-keycloak-theme
+          path: dist_keycloak/*.jar
+          if-no-files-found: error
+
+      - name: Fail if validation failed
+        if: steps.install.outcome != 'success' || steps.check.outcome != 'success' || steps.theme.outcome != 'success'
+        run: exit 1

.github/workflows/release.yml

@@ -0,0 +1,59 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: write
+  packages: write
+
+jobs:
+  release:
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v7.0.1
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 20
+
+      - name: Use pre-installed Temurin JDK 17
+        run: echo "JAVA_HOME=$JAVA_HOME_17_X64" >> "$GITHUB_ENV"
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: Build Keycloak theme JAR
+        run: npm run build:keycloak
+
+      - name: Generate checksums
+        run: sha256sum dist_keycloak/*.jar > SHA256SUMS
+
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release create "${GITHUB_REF_NAME}" dist_keycloak/*.jar SHA256SUMS --generate-notes --title "CoreLink Identity ${GITHUB_REF_NAME}"
+
+      - name: Setup Blacksmith Docker builder
+        uses: useblacksmith/setup-docker-builder@v1
+
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push Keycloak image
+        uses: useblacksmith/build-push-action@v2
+        with:
+          context: .
+          push: true
+          platforms: linux/amd64,linux/arm64
+          tags: |
+            ghcr.io/corelinkplatform/identity:${{ github.ref_name }}
+            ghcr.io/corelinkplatform/identity:latest
+          provenance: mode=max
+          sbom: true

.gitignore

@@ -0,0 +1,10 @@
+node_modules/
+dist/
+dist_keycloak/
+*.jar
+.env
+.env.*
+!.env.example
+.DS_Store
+.idea/
+.vscode/

.prettierrc.json

@@ -0,0 +1 @@
+{"semi":true,"singleQuote":false,"tabWidth":2,"trailingComma":"none","printWidth":100}

Dockerfile

@@ -0,0 +1,24 @@
+ARG KEYCLOAK_VERSION=26.7.2
+
+FROM node:22-alpine AS theme-builder
+WORKDIR /src
+ARG KEYCLOAK_THEME_NAME=corelink
+ARG VITE_BRAND_NAME=CoreLink
+ARG VITE_BRAND_TAGLINE="Secure connected intelligence"
+ENV KEYCLOAK_THEME_NAME=${KEYCLOAK_THEME_NAME}
+ENV VITE_BRAND_NAME=${VITE_BRAND_NAME}
+ENV VITE_BRAND_TAGLINE=${VITE_BRAND_TAGLINE}
+COPY package.json ./
+RUN npm pkg set name="${KEYCLOAK_THEME_NAME}" && npm install
+COPY . .
+RUN npm run build:keycloak \
+    && cp dist_keycloak/*-26.2-and-above.jar /tmp/identity-theme.jar
+
+FROM quay.io/keycloak/keycloak:${KEYCLOAK_VERSION} AS keycloak-builder
+COPY --from=theme-builder /tmp/identity-theme.jar /opt/keycloak/providers/identity-theme.jar
+RUN /opt/keycloak/bin/kc.sh build
+
+FROM quay.io/keycloak/keycloak:${KEYCLOAK_VERSION}
+COPY --from=keycloak-builder /opt/keycloak/ /opt/keycloak/
+ENTRYPOINT ["/opt/keycloak/bin/kc.sh"]
+CMD ["start", "--optimized"]

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 CoreLink Platform
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.fa.md

@@ -0,0 +1,89 @@
+# CoreLink Identity
+
+یک قالب مدرن، قابل استفاده مجدد و مناسب محیط Production برای صفحه‌های احراز هویت Keycloak که با **Keycloakify، React، TypeScript و Vite** ساخته شده است. برند پیش‌فرض CoreLink است، اما نام theme، نام برند، شعار، لوگو، رنگ‌ها و ترجمه‌ها قابل تغییر هستند و پروژه می‌تواند برای هر محصول دیگری استفاده شود.
+
+[English README](README.md) · [راهنمای نصب فارسی](docs/INSTALLATION.fa.md) · [Branding](docs/BRANDING.md) · [راهنمای Release](docs/RELEASES.md)
+
+## امکانات
+
+- رابط مدرن برای احراز هویت Keycloak بدون ظاهر پیش‌فرض Keycloak.
+- خروجی JAR قابل نصب برای Keycloak 26.2 به بالا.
+- پشتیبانی انگلیسی و فارسی با RTL واقعی.
+- پوشش flowهای استاندارد ورود، ثبت‌نام، فراموشی رمز، تأیید ایمیل، OTP/TOTP و required actionها.
+- امکان تغییر branding هنگام build.
+- Docker image چندمرحله‌ای Keycloak با theme از پیش نصب‌شده.
+- CI برای بررسی build.
+- Release خودکار شامل JAR آماده نصب، checksum و Docker image در GHCR.
+
+## سازگاری
+
+نسخه پایه فعلی Docker روی **Keycloak 26.7.2** است و theme برای `26.2-and-above` ساخته می‌شود.
+
+## اجرای سریع برای توسعه
+
+نیازمندی‌ها: Node.js 20 یا بالاتر و npm.
+
+```bash
+git clone https://github.com/CoreLinkPlatform/Identity.git
+cd Identity
+npm install
+npm run dev
+```
+
+ساخت فایل قابل نصب روی Keycloak:
+
+```bash
+npm run build:keycloak
+```
+
+خروجی پیش‌فرض:
+
+```text
+dist_keycloak/corelink-26.2-and-above.jar
+```
+
+برای نصب روی Keycloak موجود، فایل JAR را داخل `/opt/keycloak/providers/` قرار بده، `kc.sh build` را اجرا کن، Keycloak را restart کن و در **Realm settings → Themes → Login theme** مقدار `corelink` را انتخاب کن. جزئیات کامل در [docs/INSTALLATION.fa.md](docs/INSTALLATION.fa.md) آمده است.
+
+## استفاده برای محصول خودتان
+
+این repository به هیچ backend اختصاصی CoreLink وابسته نیست و می‌توان آن را fork و rebrand کرد.
+
+در Keycloakify نام واقعی theme از `package.json:name` گرفته می‌شود. پس در fork خودتان ابتدا نام package را عوض کنید و بعد branding ظاهری را هنگام build بدهید:
+
+```bash
+npm pkg set name=my-product
+VITE_BRAND_NAME="My Product" \
+VITE_BRAND_TAGLINE="Secure access" \
+npm run build:keycloak
+```
+
+بعد theme با نام `my-product` در Keycloak قابل انتخاب است. برای لوگو می‌توان فایل `public/img/corelink-mark.svg` را جایگزین کرد یا در build سورس مقدار `VITE_BRAND_MARK` را تعیین کرد. راهنمای کامل branding در [docs/BRANDING.md](docs/BRANDING.md) است.
+
+در Docker، مقدار `KEYCLOAK_THEME_NAME` داخل build stage نام package/theme را هم تنظیم می‌کند:
+
+```bash
+docker build \
+  --build-arg KEYCLOAK_THEME_NAME=my-product \
+  --build-arg VITE_BRAND_NAME="My Product" \
+  --build-arg VITE_BRAND_TAGLINE="Secure access" \
+  -t my-product-keycloak .
+```
+
+## فایل‌های Release
+
+با push کردن tagهایی مثل `v0.1.0`، GitHub Actions این خروجی‌ها را منتشر می‌کند:
+
+- `corelink-26.2-and-above.jar` — فایل نصب مستقیم نسخه رسمی CoreLink روی Keycloak.
+- `SHA256SUMS` — checksum برای بررسی صحت فایل.
+- `ghcr.io/corelinkplatform/identity:<tag>` — image آماده Keycloak همراه theme.
+- `ghcr.io/corelinkplatform/identity:latest` — آخرین image منتشرشده.
+
+راهنمای استفاده از فایل‌های Release و روند انتشار در [docs/RELEASES.md](docs/RELEASES.md) است.
+
+## مرزبندی امنیتی repository
+
+این repository عمداً شامل secret، password، realm credential، اطلاعات tenant یا تنظیمات Production CoreLink نیست. provisioning مربوط به realm/client و تنظیمات Compose/Traefik باید در لایه Deployment نگهداری شود.
+
+## مجوز
+
+MIT. استفاده شخصی و تجاری، fork، تغییر و بازتوزیع مطابق شرایط مجوز آزاد است.

README.md

@@ -1,5 +1,89 @@
 # CoreLink Identity
 
-CoreLink Identity is the branded authentication and account experience for CoreLink Platform, built on Keycloak and Keycloakify.
+A reusable, production-oriented Keycloak login theme built with **Keycloakify**, **React**, **TypeScript**, and **Vite**. It ships with CoreLink branding by default, but the theme name, visible brand name, tagline, logo asset, colors, and translations can be replaced for another product.
 
-> Initial scaffold. See the `feat/corelink-identity-foundation` pull request for the complete foundation.
+[راهنمای فارسی](README.fa.md) · [Installation](docs/INSTALLATION.md) · [Branding](docs/BRANDING.md) · [Releases](docs/RELEASES.md)
+
+## What it provides
+
+- Modern Keycloak authentication UI without exposing the default Keycloak look.
+- Keycloak 26.2+ theme JAR output.
+- English and Persian support with RTL handling.
+- Standard Keycloak login, registration, reset-password, verification, OTP/TOTP and required-action flows.
+- Build-time brand configuration.
+- Multi-stage Keycloak Docker image.
+- CI build validation.
+- Tagged releases containing a ready-to-install JAR, SHA-256 checksums and a GHCR image.
+
+## Compatibility
+
+The current image baseline is **Keycloak 26.7.2**. The generated theme target is `26.2-and-above`.
+
+## Quick start
+
+Requirements: Node.js 20+ and npm.
+
+```bash
+git clone https://github.com/CoreLinkPlatform/Identity.git
+cd Identity
+npm install
+npm run dev
+```
+
+Build the installable Keycloak theme:
+
+```bash
+npm run build:keycloak
+```
+
+The generated JAR is written to:
+
+```text
+dist_keycloak/corelink-26.2-and-above.jar
+```
+
+Install it into an existing Keycloak instance by copying the JAR to `/opt/keycloak/providers/`, running `kc.sh build`, restarting Keycloak, and selecting `corelink` under **Realm settings → Themes → Login theme**. See [docs/INSTALLATION.md](docs/INSTALLATION.md) for complete Docker and bare-Keycloak instructions.
+
+## Use it for your own product
+
+No CoreLink backend is required. The repository can be forked and rebranded independently.
+
+Keycloakify derives the actual Keycloak theme name from `package.json:name`. For a fork, set that first, then build with your visible branding:
+
+```bash
+npm pkg set name=my-product
+VITE_BRAND_NAME="My Product" \
+VITE_BRAND_TAGLINE="Secure access" \
+npm run build:keycloak
+```
+
+The resulting theme is selectable as `my-product` in Keycloak. Replace `public/img/corelink-mark.svg` or set `VITE_BRAND_MARK` when building from source. Colors and layout are documented in [docs/BRANDING.md](docs/BRANDING.md).
+
+For Docker, `KEYCLOAK_THEME_NAME` updates the package/theme name inside the build stage automatically:
+
+```bash
+docker build \
+  --build-arg KEYCLOAK_THEME_NAME=my-product \
+  --build-arg VITE_BRAND_NAME="My Product" \
+  --build-arg VITE_BRAND_TAGLINE="Secure access" \
+  -t my-product-keycloak .
+```
+
+## Releases
+
+On tags matching `v*`, GitHub Actions publishes:
+
+- `corelink-26.2-and-above.jar` — installable Keycloak theme for official CoreLink releases.
+- `SHA256SUMS` — integrity checksum file.
+- `ghcr.io/corelinkplatform/identity:<tag>` — Keycloak image with the CoreLink theme pre-installed.
+- `ghcr.io/corelinkplatform/identity:latest` — latest tagged image.
+
+See [docs/RELEASES.md](docs/RELEASES.md) for installation from release files and release-maintainer instructions.
+
+## Repository boundaries
+
+This project intentionally does **not** contain production secrets, realm credentials, database passwords, tenant data, or CoreLink deployment configuration. Realm/client provisioning and Compose/Traefik integration belong in the deployment layer.
+
+## License
+
+MIT. You can fork, modify, redistribute, and use it commercially subject to the license terms.