fix(auth): require preferred username claim

tests/auth/test_metadata_dependencies.py

@@ -81,3 +81,26 @@ async def test_current_metadata_user_rejects_invalid_keycloak_sub():
     assert exc.value.status_code == 401
     repo.get_user_by_keycloak_id.assert_not_called()
     repo.refresh_user_keycloak_snapshot.assert_not_called()
+
+
+@pytest.mark.anyio
+async def test_current_metadata_user_rejects_username_claim_fallback():
+    keycloak_id = uuid4()
+    repo = SimpleNamespace(
+        get_user_by_keycloak_id=AsyncMock(),
+        refresh_user_keycloak_snapshot=AsyncMock(),
+    )
+
+    with pytest.raises(HTTPException) as exc:
+        await metadata_dependencies.get_current_metadata_user(
+            {
+                "sub": str(keycloak_id),
+                "username": "legacy-name",
+            },
+            metadata_repo=repo,
+        )
+
+    assert exc.value.status_code == 401
+    assert exc.value.detail == "Missing preferred_username claim"
+    repo.get_user_by_keycloak_id.assert_not_called()
+    repo.refresh_user_keycloak_snapshot.assert_not_called()