feat: emit team admin role in userinfo claims when applicable

tests/Controller/Api/UserinfoControllerTest.php

@@ -70,6 +70,21 @@ class UserinfoControllerTest extends TestCase
         self::assertSame([Role::EMPLOYEE, Role::TEAMER], $claims['roles']);
     }
 
+    /**
+     * myep-team reads its own administrative role out of this claim and revokes what the claim
+     * omits, so the export is asserted here rather than left to the role policy's own tests.
+     */
+    public function testTeamAdminIsExportedOnceApproved(): void
+    {
+        $claims = $this->claims(['ROLE_OAUTH2_ROLES'], [
+            Role::USER,
+            Role::EMPLOYEE,
+            Role::TEAM_ADMIN,
+        ]);
+
+        self::assertSame([Role::EMPLOYEE, Role::TEAM_ADMIN], $claims['roles']);
+    }
+
     public function testUpstreamFailureIsReportedRatherThanAnswered(): void
     {
         $apiClient = $this->createStub(ApiClient::class);