feat: Add global administrator role support with integration tests for admin-only club endpoints.

backend/WorkClub.Api/Auth/ClubRoleClaimsTransformation.cs

@@ -54,6 +54,14 @@ public class ClubRoleClaimsTransformation : IClaimsTransformation
             return Task.FromResult(principal);
         }
 
+        // --- NEW: Skip DB role lookup if user is a global admin ---
+        var realmAccess = principal.FindFirst("realm_access")?.Value;
+        if (!string.IsNullOrEmpty(realmAccess) && realmAccess.Contains("\"admin\"", StringComparison.OrdinalIgnoreCase))
+        {
+            return Task.FromResult(principal);
+        }
+        // ---------------------------------------------------------
+
         // Look up the user's role in the database for the requested tenant
         _httpContextAccessor.HttpContext!.Items["TenantId"] = tenantId;
         var memberRole = GetMemberRole(userIdClaim, tenantId);

backend/WorkClub.Api/Program.cs

@@ -90,8 +90,8 @@ if (app.Environment.IsDevelopment())
 app.UseHttpsRedirection();
 
 app.UseAuthentication();
-app.UseMiddleware<TenantValidationMiddleware>();
 app.UseAuthorization();
+app.UseMiddleware<TenantValidationMiddleware>();
 app.UseMiddleware<MemberSyncMiddleware>();
 
 app.MapHealthChecks("/health/live", new Microsoft.AspNetCore.Diagnostics.HealthChecks.HealthCheckOptions