fix(bff): pin test JWT schemes to a static config so no OIDC metadata fetch (refs #13)

The medewerker scheme intermittently hung ~2s fetching OIDC metadata from its
(unreachable) test authority and then 401'd — clearing Authority alone left
JwtBearer's PostConfigure free to build a ConfigurationManager under CI timing. Give
both test schemes a StaticConfigurationManager so metadata is never fetched, making
token validation deterministic. Also harden AddRealmRoles to never throw (a throw in
OnTokenValidated surfaces as a 401) — a malformed realm_access yields no roles (403).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/bff/Bff.Api/Program.cs

@@ -120,10 +120,21 @@ internal static class BehandelAuth
             return;
 
         var realmAccess = principal.FindFirst("realm_access")?.Value;
-        if (string.IsNullOrEmpty(realmAccess))
+        if (string.IsNullOrWhiteSpace(realmAccess))
             return;
 
-        var roles = JsonSerializer.Deserialize<RealmAccess>(realmAccess)?.Roles ?? [];
+        // A malformed realm_access claim must not fail authentication (a throw here becomes a 401);
+        // it simply yields no roles, so the authorization policy answers 403.
+        string[] roles;
+        try
+        {
+            roles = JsonSerializer.Deserialize<RealmAccess>(realmAccess)?.Roles ?? [];
+        }
+        catch (JsonException)
+        {
+            return;
+        }
+
         foreach (var role in roles)
             identity.AddClaim(new Claim(identity.RoleClaimType, role));
     }