Show the signed-in role in the header

RBAC is what this demo argues, so which persona you are signed in as
should never be a guess while presenting.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/layout/Shell.jsx

@@ -27,7 +27,10 @@ export default function Shell() {
         <div className="shell__who">
           <div className="shell__user">
             <strong>{user?.name || user?.email || 'Signed in'}</strong>
-            <span>{user?.email}</span>
+            {/* The role is shown because RBAC is the demo: what this person can
+                and cannot do is the point, so who they are signed in as should
+                never be a guess. */}
+            <span>{(user?.roles || []).join(', ') || user?.email}</span>
           </div>
           <button type="button" className="shell__signout" onClick={signOut}>
             Sign out