fix: syncOidcRoles uses direct roles only, always overwrites

- Expose getDirectRolesForUser on RbacService interface so syncOidcRoles
  compares against directly-assigned roles only, not group-inherited ones
- Remove early-return that preserved existing roles when OIDC returned
  none — now always applies defaultRoles as fallback
- Update CLAUDE.md and SERVER-CAPABILITIES.md to reflect changes

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cameleer3-server-app/src/main/java/com/cameleer3/server/app/rbac/RbacServiceImpl.java

@@ -239,7 +239,8 @@ public class RbacServiceImpl implements RbacService {
         return max;
     }
 
-    private List<RoleSummary> getDirectRolesForUser(String userId) {
+    @Override
+    public List<RoleSummary> getDirectRolesForUser(String userId) {
         return jdbc.query("""
                 SELECT r.id, r.name, r.system FROM user_roles ur
                 JOIN roles r ON r.id = ur.role_id WHERE ur.user_id = ?

cameleer3-server-app/src/main/java/com/cameleer3/server/app/security/OidcAuthController.java

@@ -174,18 +174,6 @@ public class OidcAuthController {
     }
 
     private void syncOidcRoles(String userId, List<String> oidcRoles, OidcConfig config) {
-        // If OIDC returned no roles and user already has local roles, preserve them
-        if (oidcRoles.isEmpty()) {
-            Set<UUID> current = rbacService.getEffectiveRolesForUser(userId).stream()
-                    .filter(r -> SystemRole.isSystem(r.id()))
-                    .map(RoleSummary::id)
-                    .collect(Collectors.toSet());
-            if (!current.isEmpty()) {
-                log.info("syncOidcRoles: userId={}, no OIDC roles, preserving existing roles: {}", userId, current);
-                return;
-            }
-        }
-
         List<String> roleNames = !oidcRoles.isEmpty() ? oidcRoles : config.defaultRoles();
         log.info("syncOidcRoles: userId={}, oidcRoles={}, defaultRoles={}, using={}",
                 userId, oidcRoles, config.defaultRoles(), roleNames);
@@ -199,8 +187,8 @@ public class OidcAuthController {
             }
         }
 
-        // Current system roles (excludes group-inherited roles)
-        Set<UUID> current = rbacService.getEffectiveRolesForUser(userId).stream()
+        // Only compare against directly-assigned roles (not group-inherited)
+        Set<UUID> current = rbacService.getDirectRolesForUser(userId).stream()
                 .filter(r -> SystemRole.isSystem(r.id()))
                 .map(RoleSummary::id)
                 .collect(Collectors.toSet());