feat: 0.5.0 — config-driven RBAC seed + JWT tenant resolver

[jlc488]

Two features for 0.5.0, both lowering the "do it yourself" barrier.

1. Config-driven RBAC seed — devslab.kit.bootstrap.seed

Ship starter permissions + roles so consumers don't hand-create them in the console. Declare your domain's permission codes and the roles that group them; the kit creates whatever is missing and grants it, idempotently on boot:

devslab:
  kit:
    bootstrap:
      enabled: true
      seed:
        permissions: [tasks.read, tasks.write, tasks.update, tasks.delete]
        roles:
          viewer: [tasks.read]
          editor: [tasks.read, tasks.write, tasks.update]
          owner:  [tasks.read, tasks.write, tasks.update, tasks.delete]

• Additive only — every boot creates what's missing and adds listed grants; never revokes or deletes (destructive reconciliation stays the dev-only job of config-sync mirror). Change the config + redeploy → picked up.
• A permission referenced by a role but absent from permissions is auto-created.
• Permissions are global; roles are created in bootstrap.tenant-id.
• DevslabKitProperties.Bootstrap.Seed + DevslabKitBootstrapRunner.seedDeclaredRbac() (shared ensurePermissionId/ensureRoleId helpers factored out of the admin bootstrap).

2. JWT tenant resolver — resolver: jwt now works

devslab.kit.tenant.resolver: jwt previously threw at startup ("requires the not-yet-shipped oauth2-resource-server-starter"). It now resolves the active tenant from the kit-issued bearer token's tenant claim (the token already carries it), falling back to default-tenant-id when there's no token.

• JwtTenantResolver (tenant-core) — reads Authorization: Bearer, parses via AuthTokenService, uses CurrentUser.tenantId(); same request-access pattern as HeaderTenantResolver. tenant-core gains compileOnly(identity-api) only — a consumer on another resolver never pulls identity.
• TenantAutoConfiguration case JWT wires it (AuthTokenService via ObjectProvider; clear error if identity is absent).
• Scope: reads the kit's own HS256 token. Validating external OAuth2/OIDC tokens (JWKS, issuer, configurable claim) remains a separate future concern — the docs say so.

Tests (sample-app, Testcontainers)

• BootstrapSeedTests (4): declared permissions + roles + grants created, role-only permission auto-created, grants exact.
• JwtTenantResolverTests (3): wiring, resolves acme from a bearer token, falls back to default without one.

Docs / release surfaces

• configuration reference + bootstrap/access/tenancy guides (EN/KO); jwt row corrected from "reserved" → working.
• CHANGELOG 0.5.0 (EN/KO); README + installation + tutorial + roadmap version refs bumped to 0.5.0.

Verification: ./gradlew build → BUILD SUCCESSFUL; new tests 3/0/0 + 4/0/0, suite-wide failures=0 errors=0; mkdocs build --strict clean.

---

KO 요약: 0.5.0 두 기능 — (1) bootstrap.seed로 스타터 권한·역할을 부팅 시 멱등 시드(추가형, 역할 참조 권한 자동생성), (2) resolver: jwt가 이제 kit 자체 토큰의 tenant 클레임으로 실제 동작(무토큰 시 default 폴백; 외부 OIDC는 범위 밖). 테스트 7개 0/0, 전체 빌드 그린, docs strict clean.