Merge RB-13 — land Session -> Principal, add MedewerkerAdapter

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

# Conflicts:
#	libs/shared/docs/behaviour-spec.mdx

libs/shared/docs/behaviour-spec.mdx

@@ -20,7 +20,7 @@ tested where._
 
 Every bullet below is a real test name from the suite — an `it()` title (frontend) or a test
 method name (backend), read as a sentence. Nothing here is hand-written prose: this page
-**is** the suite, reshaped for a business reader. 445 frontend behaviours across
+**is** the suite, reshaped for a business reader. 451 frontend behaviours across
 9 contexts; 231 backend behaviours across 39 test
 classes.
 
@@ -30,17 +30,26 @@ classes.
 
 #### isAuthenticated
 
-- narrows a present session to Session
-- reports no session as not authenticated
-- narrows a present session to Session
-- reports no session as not authenticated
+- narrows a present principal to Principal
+- reports no principal as not authenticated
+- narrows a present principal to Principal
+- reports no principal as not authenticated
 
-#### parseStoredSession
+#### parseRollen
+
+- parses a single recognized rol
+- is case-insensitive and trims whitespace
+- drops unrecognized tokens (the deny-path toggle, e.g. ?rollen=geen)
+- returns an empty list for an empty string
+
+#### parseStoredPrincipal
 
 - returns null when nothing is stored
 - returns null for a non-JSON string
 - returns null when the stored shape is wrong (no naam)
-- G1: a stored bsn is never restored, even if present in the raw value
+- returns null when kind is not medewerker
+- returns null when rollen holds an unrecognized token
+- restores a well-shaped stored principal as-is (no BSN to strip)
 - returns null when nothing is stored
 - returns null for a non-JSON string
 - returns null when the stored shape is wrong (no naam)

libs/shared/src/infrastructure/subject.interceptor.ts

@@ -12,7 +12,7 @@ import { currentSubject } from './subject';
  * middleware resolves a `CallerIdentity` for every request, not just some endpoints.
  *
  * **BSN source — a deliberate compromise, read before changing:** the "obvious"
- * source would be the authenticated `Session.bsn` held by each app's own
+ * source would be the authenticated `Principal.bsn` held by each app's own
  * `SessionStore`, but `libs/shared` may not depend on an app-local `auth` context
  * (the import-direction rule), and the one sanctioned cross-context seam —
  * `SessionPort` (`@shared/application/session.port`) — deliberately exposes only

libs/shared/src/infrastructure/subject.ts

@@ -3,7 +3,7 @@ import { isDevMode } from '@angular/core';
 /**
  * Dev-only role stand-in's sibling (the reading MECHANISM for `X-Subject`; see
  * `role.ts`'s own doc comment for the twin `X-Role` mechanism this mirrors). This
- * POC has no real DigiD identity — `Session.bsn` lives only in each app's own
+ * POC has no real DigiD identity — `Principal.bsn` lives only in each app's own
  * in-memory `SessionStore` and is deliberately never persisted (see that store's G1
  * comment) — so `subject.interceptor.ts` can't reach it without a layering
  * violation (`libs/shared` may not depend on an app-local `auth` context). Instead a