fix(backend): use JWT claims for admin role checks instead of stale cached roles

Problem

When a Keycloak admin assigns a new role to a user, the backend continues rejecting requests with 403 for up to 60s after the user re-logs in.

Root cause: requireAdmin middleware reads req.user.roles (ArangoDB cached user, 60s TTL) instead of the verified JWT req.claims.realm_access.roles. When roles change in Keycloak:

1. Existing JWT tokens don't include the new role until refreshed
2. Backend caches the ArangoDB user (stale roles) for 60s
3. Frontend reads JWT directly → shows correct roles → but backend rejects

Fix

• requireAdmin: read req.claims.realm_access.roles (always fresh from verified JWT)
• /api/me/context: return JWT roles with Keycloak noise filtered (offline_access, uma_authorization, default-roles-*)
• Update 8 unit tests to set req.claims in mocks

Files changed

• components/gov-chat-backend/middleware/keycloak-auth-middleware.js
• components/gov-chat-backend/routes/user-routes.js
• components/gov-chat-backend/__tests__/keycloak-auth-middleware.test.js
• components/gov-chat-backend/__tests__/routes/user-routes.test.js

All 1543 tests pass.