[nooby6]

Summary

• Add Spring Security OAuth2 Resource Server support for JWT bearer tokens.
• Validate JWTs against configurable OIDC issuer and JWK-set endpoints.
• Map top-level roles and Keycloak realm_access.roles claims to Spring role authorities.
• Require authentication for every API route.
• Restrict employee creation and leave mutations to ADMIN/HR, and shift mutations to ADMIN/SCHEDULER.
• Derive shift/leave audit actor IDs from the validated JWT sub claim instead of trusting X-Actor-Id.
• Add converter and MockMvc authorization tests.
• Document role policies and the requirement to provision an OIDC identity provider.

Security notes

This PR configures the resource server; it does not deploy an identity provider or create users/roles. Configure JWT_ISSUER_URI and JWT_JWK_SET_URI to match the deployed provider.

Validation

GitHub Actions will run the Gradle suite, including PostgreSQL integration tests.