feat: add employee-only supervisor role nominated by crm selection 1487

docs/buspronet-schema/crm-selection-queries.md

@@ -24,6 +24,7 @@ Symfony roles:
 | `1478` | `ROLE_GROUPS_ADMIN` |
 | `1483` | `ROLE_CUSTOMER_EXPERT` |
 | `1484` | `ROLE_TEAM_ADMIN` (not consumed here — exported through `/api/userinfo` for myep-team) |
+| `1487` | `ROLE_SUPERVISOR` (not consumed here — exported through `/api/userinfo` for ephub) |
 | label `Hausleitung {CODE}` | `ROLE_HOUSE_MANAGER` + hotel code `{CODE}` |
 | nothing matched | `ROLE_CUSTOMER` |
 
@@ -45,7 +46,7 @@ filtered before anything is stored:
 | --- | --- | --- |
 | `ROLE_TEAMER` | granted | granted |
 | `ROLE_HOUSE_MANAGER` | nominated | nominated |
-| `ROLE_ADMIN`, `ROLE_TEAM_ADMIN`, `ROLE_MANAGER`, `ROLE_GROUPS_ADMIN`, `ROLE_GROUPS_MANAGER`, `ROLE_CUSTOMER_EXPERT` (`Role::EMPLOYEE_ONLY`) | **ignored** | nominated |
+| `ROLE_ADMIN`, `ROLE_TEAM_ADMIN`, `ROLE_MANAGER`, `ROLE_GROUPS_ADMIN`, `ROLE_GROUPS_MANAGER`, `ROLE_CUSTOMER_EXPERT`, `ROLE_SUPERVISOR` (`Role::EMPLOYEE_ONLY`) | **ignored** | nominated |
 
 - **Staff address**: the login email's domain is listed in `employee_email_domains`
   (`config/services.yaml`, exact match, never a suffix). Such an account also gets