Fix Keycloak roles in Spring Security with custom JWT converter

Spring Security's default JWT converter ignores Keycloak's role structure, causing @PreAuthorize checks to fail silently. Keycloak stores roles in realm_access.roles and resource_access claims, not the scope claim Spring expects. Developers must write a custom converter to map these roles to GrantedAuthority objects.