Package-level declarations

INTERIM default UserRolesSource: identity passthrough — the granted userRoleId is handed back unchanged as the "resolved" access id.

Network-backed UserRolesSource skeleton: resolves the granted auth userRoleIds to the engine-keyed CMS accessRestrictionIds via the backend user-roles endpoint.

Pure (side-effect free) builder of UserRoleAccess from the server-granted per-property roles plus the access-locked property list.

Resolution seam between the auth grants and the engine's access keys.