2f9ac51570
derive JWT roles from FetchUserByEmail (not GetRoleIDsFromEmail) keep /me primary role as role_id exclude primary role from additional_role_id (empty if no extra roles) add project-to-role debug logs for role source tracing