Design the authentication strategy for a banking application (EazyBank) with a separate Angular frontend and Spring Boot backend microservices.

Use OAuth2/OIDC with a central Authorization Server (Keycloak or Spring Authorization Server): the Angular app performs Authorization Code + PKCE against the Auth Server (never touching backend credentials directly), receiving a JWT access token. Each backend microservice (Accounts, Loans, Cards) acts as a stateless resource server, validating the JWT locally via JWKS, with fine-grained authorization enforced through role/authority claims mapped from the token, plus method-level @PreAuthorize checks for ownership rules like 'this account belongs to this user'.