--------------------------------------------------------------------------
 resource server profiles: stub,propsroles
--------------------------------------------------------------------------
--------------------------------------------------------------------------
 1. alice - realm role USER, client role reports-reader
--------------------------------------------------------------------------
  header: {"kid": "stub-key-1", "typ": "JWT", "alg": "RS256"}
  iss                "http://localhost:9000"
  aud                "reports-api"
  scope              "profile:read reports:read"
  preferred_username "alice"
  realm_access       {"roles": ["USER"]}
  resource_access    {"reports-api": {"roles": ["reports-reader"]}}

$ GET /api/me        (which authorities did the converter produce?)
HTTP 200
{
    "name": "alice",
    "authorities": [
        "FACTOR_BEARER",
        "ROLE_USER"
    ],
    "iss": "http://localhost:9000",
    "aud": [
        "reports-api"
    ],
    "typ": "JWT",
    "kid": "stub-key-1",
    "exp": "2026-08-23T10:33:19Z"
}


$ GET /api/reports   (needs ROLE_reports-reader, from resource_access)
HTTP 403
WWW-Authenticate: Bearer error="insufficient_scope", error_description="The request requires higher privileges than provided by the access token.", error_uri="https://tools.ietf.org/html/rfc6750#section-3.1"

$ GET /api/admin/stats (needs ROLE_ADMIN, from realm_access)
HTTP 403
WWW-Authenticate: Bearer error="insufficient_scope", error_description="The request requires higher privileges than provided by the access token.", error_uri="https://tools.ietf.org/html/rfc6750#section-3.1"
--------------------------------------------------------------------------
 2. root - realm roles USER and ADMIN
--------------------------------------------------------------------------

$ GET /api/me
HTTP 200
{
    "name": "root",
    "authorities": [
        "FACTOR_BEARER",
        "ROLE_ADMIN",
        "ROLE_USER"
    ],
    "iss": "http://localhost:9000",
    "aud": [
        "reports-api"
    ],
    "typ": "JWT",
    "kid": "stub-key-1",
    "exp": "2026-08-23T10:33:19Z"
}


$ GET /api/admin/stats
HTTP 200
{
    "secret": "only ROLE_ADMIN sees this"
}