feat: align role assignment logic with myep-team

src/Controller/Api/UserinfoController.php

@@ -55,7 +55,7 @@ class UserinfoController extends AbstractController
 
             // Patch current user's roles. The implicit ROLE_USER says nothing about the
             // account — every authenticated user holds it — and is not exported.
-            $data->roles = Role::assignedOnly($user->getRoles());
+            $data->roles = Role::effectiveOnly($user->getRoles());
 
             // Patch current user's hotel codes
             $data->hotelCodes = $user->getHotelCodes();