--------------------------------------------------------------------------
 resource server profiles: stub,propsroles-broken,tracespel
--------------------------------------------------------------------------
--------------------------------------------------------------------------
 1. alice - realm role USER, client role reports-reader
--------------------------------------------------------------------------
  header: {"kid": "stub-key-1", "typ": "JWT", "alg": "RS256"}
  iss                "http://localhost:9000"
  aud                "reports-api"
  scope              "profile:read reports:read"
  preferred_username "alice"
  realm_access       {"roles": ["USER"]}
  resource_access    {"reports-api": {"roles": ["reports-reader"]}}

$ GET /api/me        (which authorities did the converter produce?)
HTTP 200
{
    "name": "alice",
    "authorities": [
        "FACTOR_BEARER",
        "ROLE_USER"
    ],
    "iss": "http://localhost:9000",
    "aud": [
        "reports-api"
    ],
    "typ": "JWT",
    "kid": "stub-key-1",
    "exp": "2026-08-23T11:00:53Z"
}


$ GET /api/reports   (needs ROLE_reports-reader, from resource_access)
HTTP 403
WWW-Authenticate: Bearer error="insufficient_scope", error_description="The request requires higher privileges than provided by the access token.", error_uri="https://tools.ietf.org/html/rfc6750#section-3.1"

$ GET /api/admin/stats (needs ROLE_ADMIN, from realm_access)
HTTP 403
WWW-Authenticate: Bearer error="insufficient_scope", error_description="The request requires higher privileges than provided by the access token.", error_uri="https://tools.ietf.org/html/rfc6750#section-3.1"
--------------------------------------------------------------------------
 2. root - realm roles USER and ADMIN
--------------------------------------------------------------------------

$ GET /api/me
HTTP 200
{
    "name": "root",
    "authorities": [
        "FACTOR_BEARER",
        "ROLE_ADMIN",
        "ROLE_USER"
    ],
    "iss": "http://localhost:9000",
    "aud": [
        "reports-api"
    ],
    "typ": "JWT",
    "kid": "stub-key-1",
    "exp": "2026-08-23T11:00:53Z"
}


$ GET /api/admin/stats
HTTP 200
{
    "secret": "only ROLE_ADMIN sees this"
}


--------------------------------------------------------------------------
 what the resource server logged, at TRACE, while producing that 403
--------------------------------------------------------------------------
  Failed to evaluate expression. error=EL1008E: Property or field 'reports' cannot be found on object of type 'java.util.Collections$UnmodifiableMap' - maybe not public or not valid?
  Found authorities with expression. authorities=[USER, ADMIN]
  Found authorities with expression. authorities=[USER]
  Looking for authorities with expression. expression=[realm_access][roles]
  Looking for authorities with expression. expression=[resource_access][reports-api][roles]