resolveAccessRestrictionIds

Map the granted auth roles to the engine-keyed CMS access restriction ids.

Return

propertyId -> CMS accessRestrictionId. A property absent from the result is "unresolved" — consumers fall back to the safe interim passthrough for that entry. Implementations should never return null; callers defensively treat null as "resolution unavailable" (full passthrough).

Parameters

userRoleIdsByProperty

propertyId -> granted userRoleId from the login response.