PR 2 of 3 from the user-menu chantier.
* New lazy-loaded `/profile` route in `apps/portal-admin`. Renders
the active admin session's identity card (displayName, username,
oid, tid) plus an "App roles" card listing the Entra app-role
claims attached to the session — `Portal.Admin` today, additional
business roles when the strategic security baseline ADR lands.
* `authGuard` (from `feature-auth`) gates the route — anonymous
visitors bounce through the BFF's `/api/admin/auth/login`. The
template's `@if (user())` then narrows the type so the page can
drop the anonymous branch.
* The `User Menu`'s Profile entry (PR 1) already points at `/profile`
so the link starts working on this surface as soon as this lands.
* `CurrentUser.roles` extended with an optional `readonly string[]`
— the admin-side `/api/admin/auth/me` already returns the claim;
the type now captures it. User-portal `/me` keeps omitting it per
ADR-0009 (PR 3 surfaces it via the dedicated capabilities endpoint).
* Lazy chunk lands at 5.37 KB raw / 1.57 KB gzip — comfortably under
the lazy-chunk budget.
Julien Gautier