Add local mock for NABat's GraphQL API and file-download pipeline

[naglepuff]

Summary

BatAI's NABat integration could previously only be exercised locally as far as the Keycloak login flow - actual recording fetches still hit NABat's real GraphQL API and S3 storage, neither of which is reachable from a local dev setup. Since BatAI never uses a real GraphQL client (every query is a plain templated string with no schema or variables), this adds a minimal stand-in service that dispatches on substrings in the query text instead of running an actual GraphQL server.

Renames dev/keycloak to dev/nabat_mock and docker-compose-keycloak.yml to docker-compose-nabat-mock.yml, and adds:

• mock_server.py: mocks the single-recording fetch query, the annotation-push mutation, and the presigned-URL access check, generating real presigned URLs against the existing minio service so the download and spectrogram-generation pipeline runs end to end. Also seeds one already-vetted annotation per newly-fetched recording, so the annotations list isn't empty on first load.
• upload_recording.py: uploads a .wav file (defaulting to the repo's own assets/example.wav) into minio for those presigned URLs to resolve to.
• Env wiring for both full-Docker and native (host-run Django/celery) development, since the two need different minio hostnames baked into the signed URLs.
• A Keycloak realm fix: the sub claim was missing from access tokens under this realm's lightweight-token configuration, which broke annotation creation.

Scoped to the single-recording fetch flow only - NABat's new "file list" feature (tracked separately) and species sync are not mocked.

Test plan

• ruff check / ruff format --check on all new Python files
• Full local round trip verified manually: Keycloak login → code exchange → nabat_recording_initialize → real download from minio → real spectrogram generation
• Verified updateAcousticFileVet mutation mock and seeded annotation via direct queries to the running mock
• Verified the sub claim fix against a fresh Keycloak realm import
• CI

🤖 Generated with Claude Code