fix: normalize roles claim to array before role check

[yogeshchoudhary147]

Summary

• Roles claim emitted as a plain string by an Auth0 Action caused defineRouteAuth and RequireRole to fall back to String.prototype.includes, allowing substring-based role bypass (e.g. billing-admin passing a check for admin)
• Added normalizeRoles helper in both src/server/middleware.ts and src/client/components.tsx to coerce the claim to string[] before matching
• Added regression tests covering exact-match string claim and substring-attack scenario in both middleware and component test files

Test plan

• npm test passes (345 tests)
• npm run typecheck passes
• User with billing-admin role is denied access to route requiring admin
• User with admin role as a string (not array) is granted access to route requiring admin