feat: derive ROLE_EMPLOYEE from the account's email domain

tests/Security/RoleTest.php

@@ -93,6 +93,35 @@ class RoleTest extends TestCase
         self::assertSame([Role::ADMIN => 'Administration'], Role::nominatedFrom($roles));
     }
 
+    public function testEmployeeIsGrantedOutrightAndDisplacesTheCustomerFallback(): void
+    {
+        // The claim does not come from the CRM, but it travels the same path as one.
+        self::assertSame([Role::EMPLOYEE], Role::sync([], [Role::EMPLOYEE]));
+    }
+
+    public function testEmployeeIsRevokedOnceItIsNoLongerClaimed(): void
+    {
+        // Somebody whose address left the staff domain: no claim, so the role goes, and with no
+        // effective role left the fallback returns.
+        self::assertSame([Role::CUSTOMER], Role::sync([Role::EMPLOYEE], []));
+    }
+
+    public function testEmployeeDoesNotShortCircuitTheNominationOfAnAdministrativeRole(): void
+    {
+        self::assertSame(
+            [Role::EMPLOYEE, Role::pending(Role::ADMIN)],
+            Role::sync([], [Role::EMPLOYEE, Role::ADMIN]),
+        );
+    }
+
+    public function testEmployeeAndTeamerCoexist(): void
+    {
+        self::assertSame(
+            [Role::TEAMER, Role::EMPLOYEE],
+            Role::sync([], [Role::TEAMER, Role::EMPLOYEE]),
+        );
+    }
+
     public function testEveryRoleAndNominationHasALabel(): void
     {
         $labels = Role::labels();