Refresh portal sessions and role authorization through Keycloak

Fix the confirmed Spiritech authorization loss after 15 minutes. Add shared cookie session revalidation through Keycloak refresh tokens for tester and staff roles, preserving client-scoped beta authorization and bounded revocation. Replace stale role claims, validate refreshed identity, rotate stored tokens and fail closed on invalid refresh. Verify refresh success, revocation, wrong identity/client, expired sessions and authentication failures with automated tests; build portal. Implemented shared cookie validation: first request after 10 minutes refreshes against Keycloak, validates signed ID token issuer/audience/lifetime and unchanged issuer/subject, maps current userinfo, replaces all prior identities/roles, rotates tokens and renews cookie. One-minute bounded per-process single-flight cache coordinates parallel rotation; invalid refresh signs out without logging credentials. Current single-instance deployment verified; multi-replica coordination limitation documented. Validation: portal build passes with zero warnings using existing dependency outputs (BuildProjectReferences=false; full dependency rebuild blocked by container native tooling). 39 focused refresh, bug reporting/page and forms API/page tests pass. Tests include signed fake Keycloak responses, wrong signature/issuer/audience/subject, role revocation, wrong-client beta roles, parallel rotation and actual Kestrel HTTP cookie renewal. Review finding on identity-binding fixture corrected and retested. git diff --check clean. Live Keycloak validation and deployment remain outstanding. Pull request #2725: https://git.project-rk.com/prk/engines/pulls/2725 Branch fix/refresh-portal-session-roles targets develop; commit 02ee33676 includes only the five session files. Validation rerun on the latest develop base with a native-tooling SDK image: full portal/dependency build passes with zero warnings/errors and all 39 focused tests pass. The earlier dependency-rebuild tooling limitation is resolved. Working tree clean after removing generated build artifacts.