UserRolesSource

Resolution seam between the auth grants and the engine's access keys.

The auth service grants a per-property userRoleId (historically called "accessRoleId" in the login response). That id is NOT the engine's accessLevelId: the positioning engine keys restricted entities on the CMS accessRestrictionId. Implementations of this seam map one to the other so fromGrantedRoles can publish RoleAccessPair(roleId = userRoleId, accessLevelId = resolvedRestrictionId).

Implementations:

• IdentityUserRolesSource — INTERIM default: identity passthrough. Safe because the engine degrades an unknown non-empty accessLevelId to the DEFAULT level (fail-closed-to-default), so an unresolved id can never over-grant — but it is unenforcing (specific restriction levels are not applied).
• NetworkUserRolesSource — resolves against the backend user-roles endpoint. TODO(backend): the resolution endpoint is not deployed yet; the URL stays injectable/unconfigured until the backend publishes it.

Inheritors