An RBAC bridge maps admin groups in staging and drops them in production

The token includes the right groups, yet one environment's mapper reads the old claim shape and silently returns no admin roles.