fix: exempt /api/clubs/me from tenant validation

- Add path exemption in TenantValidationMiddleware for /api/clubs/me
- Change authorization policy from RequireMember to RequireViewer
- Fix KEYCLOAK_CLIENT_ID in docker-compose.yml (workclub-app not workclub-api)
- Endpoint now works without X-Tenant-Id header as intended
- Other endpoints still protected by tenant validation

This fixes the chicken-and-egg problem where frontend needs to call
/api/clubs/me to discover available clubs before selecting a tenant.

.sisyphus/evidence/final-qa/s35-past-shift.json

@@ -0,0 +1,2 @@
+{"id":"e2245cb5-b0a4-4e33-a255-e55b619859ac","title":"Past Shift Test","description":"This shift is in the past","location":null,"startTime":"2026-01-01T08:00:00+00:00","endTime":"2026-01-01T12:00:00+00:00","capacity":5,"signups":[],"clubId":"00000000-0000-0000-0000-000000000000","createdById":"0fae5846-067b-4671-9eb9-d50d21d18dfe","createdAt":"2026-03-05T19:56:29.4809132+00:00","updatedAt":"2026-03-05T19:56:29.4809132+00:00"}
+HTTP_CODE:201