chore(hotfix/9.24.5): Release v9.25.0

[github-actions]

🤖 I have created a release beep boop

9.25.0 (2026-08-27)

Features

• sonarqube: provision SONAR_TOKEN as GitLab group CI variable (0041167)

Bug Fixes

• ci: change how hotfixes or main branch are detected for release-please (d13acb3)
• ci: correct keycloak healthcheck flag typo (fsS -> -fsS) (9f3d631)
• ci: query keycloak health endpoint on management port 9000 (4d949c6)
• ci: surface keycloak boot logs on Playwright failure (16af455)
• client: map footer version label and link to pr/sha/tag (3f48049)
• client: map footer version link to release tag or PR instead of 404 (04eb1df), closes #2566
• gitlab: return existing user on 409 instead of failing sync (14932f3)
• keycloak: preserve full path when creating role groups (352ab56)
• server-nestjs: delete owned GitLab repos on explicit repository deletion (517fb32)
• server-nestjs: guard createUser against non-string GitLab error descriptions (826154d)
• server-nestjs: include projectsRootDir in vault techRO policy path (ea43bae)
• server-nestjs: match GitLab validation errors with object descriptions (09d8cac), closes #2544
• server-nestjs: never purge system GitLab repos (infra-apps, mirror) on reconciliation (94ccb65)
• server-nestjs: purge argocd values files on project delete (3bf56df)
• server-nestjs: resolve Keycloak root group by path, not name (71ba0e8)
• server-nestjs: surface post-creation repository sync failure (e0e8c3e)

Miscellaneous Chores

• ci: do not use versioning-strategy on release-please GHA (74298f4)
• server-nestjs: align gitlab constants comment style (8ff4d34)

Refactoring

• keycloak: parse group representations at the client boundary (a4e4902)
• server-nestjs: add upsertProjectGroupSystemRepo wrapper (c11a4e4)
• server-nestjs: name gitlab purge e2e timeout constant (22bed7e)
• server-nestjs: rename isInternalRepo to isDeclaredRepo (9326580)
• server-nestjs: reuse VAULT_PROVISION_TIMEOUT, rename e2e-timeout to constants (fb7bc9d)
• server-nestjs: specialize e2e timeouts per service (729819b)
• server-nestjs: split isSystemRepo into isSystemRepo and isInternalRepo (17b5e39)

---

This PR was generated with Release Please. See documentation.