pub static PA_ADMIN: &str
Keycloak role name that grants full admin access (bypasses HSM-group scoping checks).