UID2-7271: add CREATE role for Claude admin automation

Maps the new uid2.admin.create Okta scope to Role.CREATE and grants it
access to the five add endpoints: site, client key, operator key,
service link, and CSTG keypair. This keeps create access separate from
read-only so Claude can request only the scope it needs for each task.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: sophia-chen-ttd

src/main/java/com/uid2/admin/auth/OktaCustomScope.java

@@ -14,6 +14,7 @@ public enum OktaCustomScope {
     METRICS_EXPORT("uid2.admin.metrics-export", Role.METRICS_EXPORT),
     ENCLAVE_REGISTRAR("uid2.admin.enclave-registrar", Role.ENCLAVE_REGISTRAR),
     READ_ONLY("uid2.admin.read-only", Role.READ_ONLY),
+    CREATE("uid2.admin.create", Role.CREATE),
     INVALID("invalid", Role.UNKNOWN);
     private final String name;
     private final Role role;

src/main/java/com/uid2/admin/vertx/service/ClientKeyService.java

@@ -95,7 +95,7 @@ public void setupRoutes(Router router) {
             synchronized (writeLock) {
                 this.handleClientAdd(ctx);
             }
-        }, new AuditParams(List.of("name", "roles", "site_id"), Collections.emptyList()), Role.MAINTAINER, Role.SHARING_PORTAL));
+        }, new AuditParams(List.of("name", "roles", "site_id"), Collections.emptyList()), Role.MAINTAINER, Role.SHARING_PORTAL, Role.CREATE));
 
         router.post(API_CLIENT_DEL.toString()).blockingHandler(auth.handle((ctx) -> {
             synchronized (writeLock) {

src/main/java/com/uid2/admin/vertx/service/ClientSideKeypairService.java

@@ -70,7 +70,7 @@ public void setupRoutes(Router router) {
             synchronized (writeLock) {
                 this.handleAddKeypair(ctx);
             }
-        }, new AuditParams(Collections.emptyList(), List.of("site_id", "name", "contact", "disabled")), Role.MAINTAINER, Role.SHARING_PORTAL));
+        }, new AuditParams(Collections.emptyList(), List.of("site_id", "name", "contact", "disabled")), Role.MAINTAINER, Role.SHARING_PORTAL, Role.CREATE));
         router.post(API_CLIENT_SIDE_KEYPAIRS_UPDATE.toString()).blockingHandler(auth.handle((ctx) -> {
             synchronized (writeLock) {
                 this.handleUpdateKeypair(ctx);

src/main/java/com/uid2/admin/vertx/service/OperatorKeyService.java

@@ -85,7 +85,7 @@ public void setupRoutes(Router router) {
             synchronized (writeLock) {
                 this.handleOperatorAdd(ctx);
             }
-        }, new AuditParams(List.of("name", "protocol", "site_id", "operator_type", "roles"), Collections.emptyList()), Role.MAINTAINER));
+        }, new AuditParams(List.of("name", "protocol", "site_id", "operator_type", "roles"), Collections.emptyList()), Role.MAINTAINER, Role.CREATE));
 
         router.post(API_OPERATOR_DEL.toString()).blockingHandler(auth.handle((ctx) -> {
             synchronized (writeLock) {

src/main/java/com/uid2/admin/vertx/service/ServiceLinkService.java

@@ -55,7 +55,7 @@ public void setupRoutes(Router router) {
             synchronized (writeLock) {
                 this.handleServiceLinkAdd(ctx);
             }
-        }, new AuditParams(Collections.emptyList(), List.of("link_id", "service_id", "site_id", "name", "roles")), Role.MAINTAINER));
+        }, new AuditParams(Collections.emptyList(), List.of("link_id", "service_id", "site_id", "name", "roles")), Role.MAINTAINER, Role.CREATE));
         router.post(API_SERVICE_LINK_UPDATE.toString()).blockingHandler(auth.handle((ctx) -> {
             synchronized (writeLock) {
                 this.handleServiceLinkUpdate(ctx);

src/main/java/com/uid2/admin/vertx/service/SiteService.java

@@ -69,7 +69,7 @@ public void setupRoutes(Router router) {
             synchronized (writeLock) {
                 this.handleSiteAdd(ctx);
             }
-        }, new AuditParams(List.of("name", "enable", "types", "description"), List.of("domain_names", "app_names")), Role.MAINTAINER, Role.SHARING_PORTAL));
+        }, new AuditParams(List.of("name", "enable", "types", "description"), List.of("domain_names", "app_names")), Role.MAINTAINER, Role.SHARING_PORTAL, Role.CREATE));
         router.post(API_SITE_ENABLE.toString()).blockingHandler(auth.handle((ctx) -> {
             synchronized (writeLock) {
                 this.handleSiteEnable(ctx);