feat: sync non-privileged BusPro roles on every login

tests/Security/RoleTest.php

@@ -38,6 +38,20 @@ class RoleTest extends TestCase
         self::assertSame([Role::CUSTOMER], Role::filterImportable([]));
     }
 
+    public function testCombineKeepsEachHalfInItsOwnLane(): void
+    {
+        $roles = Role::combine([Role::TEAMER, Role::ADMIN], [Role::GROUPS_ADMIN, Role::TEAMER]);
+
+        // The ADMIN from the synced half and the TEAMER from the privileged half are discarded.
+        self::assertSame([Role::TEAMER, Role::GROUPS_ADMIN], $roles);
+        self::assertSame(array_keys($roles), range(0, \count($roles) - 1));
+    }
+
+    public function testCombineDropsTheImplicitRoleUser(): void
+    {
+        self::assertSame([Role::TEAMER], Role::combine([Role::USER, Role::TEAMER], []));
+    }
+
     public function testEveryRoleHasALabel(): void
     {
         self::assertSame(Role::ALL, array_keys(Role::labels()));