feat: proper logging to dedicated audit channel

src/Security/MyEpAuthenticator.php

@@ -49,6 +49,9 @@ class MyEpAuthenticator extends AbstractAuthenticator
         try {
             $accessToken = $this->client->fetchAccessToken($request);
         } catch (AuthorizationRequestException|IdentityProviderException $e) {
+            $this->logger->error('Login via MyE&P failed due to unobtainable access token', [
+                'exception' => $e,
+            ]);
             throw new CustomUserMessageAuthenticationException('Invalid token');
         }
 
@@ -110,11 +113,21 @@ class MyEpAuthenticator extends AbstractAuthenticator
     {
         // User is expected to have at least one role
         if (false === isset($userinfo['roles']) || 0 === count($userinfo['roles'])) {
+            // Claim keys only, the payload itself carries the full profile
+            $this->logger->warning('Login via MyE&P failed due to missing roles claim', [
+                'claims' => array_keys($userinfo),
+            ]);
+
             return null;
         }
 
         // User is expected to have at least one of the roles teamer, manager, house manager or admin
         if ([] === array_intersect(self::ELIGIBLE_ROLES, $userinfo['roles'])) {
+            $this->logger->warning('Login via MyE&P failed due to lack of an eligible role', [
+                'roles' => $userinfo['roles'],
+                'eligible_roles' => self::ELIGIBLE_ROLES,
+            ]);
+
             return null;
         }