JWT custom claims expanded.

Improved: Tenant_id, employee_id, security_level, training_mode. Single source for every Firestore rule. training_mode custom claim opens the G_D_T training session without crossing into prod data.