Framework-level web security primitives (JSON 401 entry-point, CSRF cookie/endpoint, Keycloak claim parsing) as a Spring Boot starter