Add CORS configuration and exempt debug endpoint from tenant validation

- Add CORS policy to allow frontend requests from localhost:3000
- Exempt /api/debug endpoints from tenant validation
- Fix JSON parsing in realm_access claim checks

backend/WorkClub.Api/Middleware/TenantValidationMiddleware.cs

@@ -22,9 +22,10 @@ public class TenantValidationMiddleware
             return;
         }
 
-        // Exempt bootstrap and admin endpoints from tenant validation
+    // Exempt bootstrap, admin, and debug endpoints from tenant validation
     if (context.Request.Path.StartsWithSegments("/api/clubs/me") ||
-            context.Request.Path.StartsWithSegments("/api/admin"))
+        context.Request.Path.StartsWithSegments("/api/admin") ||
+        context.Request.Path.StartsWithSegments("/api/debug"))
     {
       _logger.LogInformation("TenantValidationMiddleware: Exempting {Path} from tenant validation", context.Request.Path);
       await _next(context);

backend/WorkClub.Api/Program.cs

@@ -31,6 +31,18 @@ builder.Services.AddScoped<MemberSyncService>();
 builder.Services.AddScoped<TenantDbTransactionInterceptor>();
 builder.Services.AddSingleton<SaveChangesTenantInterceptor>();
 
+// Add CORS to allow frontend requests
+builder.Services.AddCors(options =>
+{
+    options.AddPolicy("AllowFrontend", policy =>
+    {
+        policy.WithOrigins("http://localhost:3000")
+              .AllowAnyHeader()
+              .AllowAnyMethod()
+              .AllowCredentials();
+    });
+});
+
 builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
     .AddJwtBearer(options =>
     {
@@ -111,6 +123,8 @@ if (app.Environment.IsDevelopment())
 
 app.UseHttpsRedirection();
 
+app.UseCors("AllowFrontend");
+
 app.UseAuthentication();
 app.UseAuthorization();
 app.UseMiddleware<TenantValidationMiddleware>();
@@ -161,7 +175,12 @@ app.MapGet("/api/debug/claims", (HttpContext context) =>
         hasAuthHeader = !string.IsNullOrEmpty(authHeader),
         authHeaderPrefix = authHeader?.Substring(0, Math.Min(20, authHeader?.Length ?? 0))
     });
-}).RequireAuthorization();
+}).RequireAuthorization()
+  .AddEndpointFilter(async (context, next) =>
+  {
+      // Skip tenant validation for debug endpoint
+      return await next(context);
+  });
 
 app.MapTaskEndpoints();
 app.MapShiftEndpoints();