M2M scope mapping now accepts both 'server:admin' and 'admin' (case- insensitive). OIDC user login role assignment strips the 'server:' prefix before looking up SystemRole, so 'server:viewer' from the id_token maps to VIEWER correctly. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>