A practical guide to extending Keycloak 26 with Java 21 — building a custom authenticator, password policy provider and identity provider mapper, and keeping them working through version upgrades.