fix: drop the implicit ROLE_USER from the userinfo roles claim

src/Security/Role.php

@@ -72,6 +72,19 @@ final class Role
         return [] === $importable ? [self::CUSTOMER] : $importable;
     }
 
+    /**
+     * The roles actually assigned to an account — everything except the implicit ROLE_USER,
+     * which User::getRoles() prepends and which is never stored.
+     *
+     * @param string[] $roles
+     *
+     * @return string[]
+     */
+    public static function assignedOnly(array $roles): array
+    {
+        return array_values(array_diff($roles, [self::USER]));
+    }
+
     /**
      * The non-privileged half of a role set: what BpnAuthenticator syncs from the BusPro CRM.
      *
@@ -81,7 +94,7 @@ final class Role
      */
     public static function syncedOnly(array $roles): array
     {
-        return array_values(array_diff($roles, self::PRIVILEGED, [self::USER]));
+        return array_values(array_diff(self::assignedOnly($roles), self::PRIVILEGED));
     }
 
     /**