JWT add Labels

Lookup the _claims_ assigned in **Auth** and add them to the JWT

**GIVEN** I have an active account and been assigned claims for a product
**WHEN** I log in
**OR** change the account I'm using
**THEN** I get a newly created JWT with my _claims_ added to its _roles_

No files or tests are named. Start by tracing the Auth login and account-change flows that create JWTs, then verify how product claims are assigned and represented as roles. Done means a newly created JWT includes the account's claims after login or switching accounts.

Written by the indexing model from the issue text.