### What happened?

When `general_settings.enable_jwt_auth: true` and `enforce_rbac: true`, the model gate in `JWTAuthManager.can_rbac_role_call_model` performs an exact-string membership check against `role_permissions[].models`. Wildcard patterns that work everywhere else in LiteLLM (team `models`, key `models`, model access groups, `provider/*` patterns) are **not** expanded here. As a result:

- `models: ["bedrock-claude-*"]` does not allow `bedrock-claude-draft-rep-sonnet`. - `models: ["*"]` does not allow any concrete model name — it only matches the literal string `"*"`.

A request that should be allowed by the role's pattern is rejected with:

``` 403: Role=internal_user not allowed to call model=bedrock-claude-draft-rep-sonnet. Allowed models=['bedrock-claude-*'] ```

**Expected:** `role_permissions[].models` should support the same wildcard / access-group / `provider/*` semantics as team and key model gating, so `bedrock-claude-*` matches `bedrock-claude-draft-rep-sonnet` and `*` matches anything.

**Where the bug lives** (`litellm/proxy/auth/handle_jwt.py`, `can_rbac_role_call_model`):

```python @staticmethod def can_rbac_role_call_model( rbac_role: RBAC_ROLES,…