fix: drop the implicit ROLE_USER from the userinfo roles claim

src/Controller/Api/UserinfoController.php

@@ -8,6 +8,7 @@ use App\BusProNet\Model\Notification;
 use App\BusProNet\Model\PersonalData;
 use App\Entity\User;
 use App\Security\Crypt;
+use App\Security\Role;
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
 use Symfony\Component\HttpFoundation\JsonResponse;
 use Symfony\Component\HttpFoundation\Response;
@@ -52,8 +53,9 @@ class UserinfoController extends AbstractController
                 return new JsonResponse(['message' => $data->message, 'code' => $data->code], Response::HTTP_BAD_REQUEST);
             }
 
-            // Patch current user's roles
-            $data->roles = $user->getRoles();
+            // Patch current user's roles. The implicit ROLE_USER says nothing about the
+            // account — every authenticated user holds it — and is not exported.
+            $data->roles = Role::assignedOnly($user->getRoles());
 
             // Patch current user's hotel codes
             $data->hotelCodes = $user->getHotelCodes();