fix: include j26-booking roles

[scriptcoded]

• Adds missing roles from j26-booking
• Allows all users to create bookings
• Updates j26-map to support new localization format from j26-booking

[Copilot]

Pull request overview

This PR updates production Kubernetes manifests to (1) expand Keycloak client roles for j26-booking and grant booking self-create to the synced user group, and (2) bump the j26-map image version to a release that supports the updated localization format used by j26-booking.

Changes:

• Add missing j26-booking client roles and assign bookings:self:create to the j26-scoutid-sync group.
• Bump j26-map prod image tag from 0.2.0 to 0.2.1.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
k8s/app-manifest-prod/j26-map/kustomization.yaml	Pins prod j26-map image tag to 0.2.1 to pick up localization changes.
k8s/app-manifest-prod/j26-keycloak-scoutid/45-keycloak-config-configmap.yaml	Adds j26-booking client roles and grants bookings:self:create via the synced parent group.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[hakan-persson]

Thanks for adding the booking roles, Malcolm! 🙏 The role model itself looks right. One heads-up on the workflow here — this is an easy one to miss, so definitely not on you:

45-keycloak-config-configmap.yaml is a generated file. It's built from the source in the j26-keycloak repo (the keycloak-config/*.yaml files → kubectl create configmap … --dry-run → this file). So Keycloak changes should go in that repo first and then get regenerated into here, otherwise the source-of-truth and the deployed file drift apart. I've already ported your role changes into the source repo, so we're covered there.

There's a concrete reason this matters right now — there's a second open PR against the same generated file, and the two hand-edits each carry a different half of the truth:

	groups-claim mapper (#52)	booking roles (#55)
main	❌	❌
#52	✅	❌
#55 (this PR)	❌	✅
j26-keycloak (source)	✅	✅

Because the two edits touch different regions of the file, git will happily auto-merge them without a conflict — but whichever merges second silently ends up missing the other's change, and the config-cli sync would then strip it from prod Keycloak. #52 adds the groups claim mapper on j26-auth (already live in prod); this PR would regress it.

Proposed fix so nothing gets lost: instead of merging the two hand-edits, let's replace this file with a single clean regeneration from the source repo (which already has both the mapper and the booking roles). It'll show as a small diff that adds the mapper back on top of your role changes, and then #52 can close as absorbed. Happy to push that onto this branch, or you can regenerate on your end — whichever you prefer.

(The j26-map 0.2.0 → 0.2.1 bump is unrelated and totally fine.)