chore: correct in docs what the userinfo email claim identifies

src/Security/EpAuthenticator.php

@@ -75,9 +75,14 @@ class EpAuthenticator extends AbstractAuthenticator
             throw new CustomUserMessageAuthenticationException('Anmeldung über myep fehlgeschlagen.');
         }
 
-        // The guide is explicit that profile.communication.email comes from the CRM address
-        // record and is NOT necessarily the login email -- one address can hold several
-        // contacts. The top-level claim is the identity, and it is what User is keyed on.
+        // `email` is the address this session actually authenticated with, and it is what User
+        // is keyed on. It is not myep's account identifier -- that is the opaque, stable `sub`
+        // claim, which myep's consumer guide asks consumers to match on; keying on email here
+        // is deliberate, at the price of a myep-side email change reading as a new account.
+        // Never profile.communication.email: that is the first contact address on the BusPro
+        // record, shared by every account of the same person. myep patches this claim from the
+        // authenticated account and exports no fallback, so an absent one is a myep-side fault
+        // rather than an ungranted scope -- refused either way.
         $email = $userinfo['email'] ?? null;
         if (!\is_string($email) || '' === $email) {
             $this->logger->error('Login via myep failed: userinfo carried no email claim');