Merge RB-13 — land Session -> Principal, add MedewerkerAdapter

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

# Conflicts:
#	libs/shared/docs/behaviour-spec.mdx

libs/shared/docs/behaviour-spec.mdx

@@ -20,7 +20,7 @@ tested where._
 
 Every bullet below is a real test name from the suite — an `it()` title (frontend) or a test
 method name (backend), read as a sentence. Nothing here is hand-written prose: this page
-**is** the suite, reshaped for a business reader. 445 frontend behaviours across
+**is** the suite, reshaped for a business reader. 451 frontend behaviours across
 9 contexts; 231 backend behaviours across 39 test
 classes.
 
@@ -30,17 +30,26 @@ classes.
 
 #### isAuthenticated
 
-- narrows a present session to Session
-- reports no session as not authenticated
-- narrows a present session to Session
-- reports no session as not authenticated
+- narrows a present principal to Principal
+- reports no principal as not authenticated
+- narrows a present principal to Principal
+- reports no principal as not authenticated
 
-#### parseStoredSession
+#### parseRollen
+
+- parses a single recognized rol
+- is case-insensitive and trims whitespace
+- drops unrecognized tokens (the deny-path toggle, e.g. ?rollen=geen)
+- returns an empty list for an empty string
+
+#### parseStoredPrincipal
 
 - returns null when nothing is stored
 - returns null for a non-JSON string
 - returns null when the stored shape is wrong (no naam)
-- G1: a stored bsn is never restored, even if present in the raw value
+- returns null when kind is not medewerker
+- returns null when rollen holds an unrecognized token
+- restores a well-shaped stored principal as-is (no BSN to strip)
 - returns null when nothing is stored
 - returns null for a non-JSON string
 - returns null when the stored shape is wrong (no naam)