debug(pam): add /api/pam/whoami to inspect session roles

Temporary endpoint to verify what `realm_access.roles` Keycloak puts
into the access token vs. what NextAuth lands in session.user.roles.
Remove once the eligibility plumbing is confirmed working.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

k8s/deployment.yaml

@@ -31,7 +31,7 @@ spec:
     spec:
       containers:
         - name: my-ui
-          image: registry.gosec.internal/gsc-my/ui:v0.1.1
+          image: registry.gosec.internal/gsc-my/ui:v0.1.2
           imagePullPolicy: Always
           ports:
             - containerPort: 3000