case 4713 - customer contacts hold and act with customer roles only

Users who may edit contacts but not users (Service, Sales, Accounting) could
give a contact login any role, BizAdmin and OpsAdmin included, and roles are
what every check uses (security review F28). Now:
- saving a Customer or HeadOffice user with any role other than Customer or
  CustomerRestricted is refused (error on Roles);
- UserBiz.EffectiveRoles masks a contact's roles to the customer roles wherever
  they are applied: the token middleware, download-key routes, and the
  notification subscriber check, so contacts that already have staff roles
  stored act without them.

Checked: Service creating a contact with BizAdmin refused, with Customer works;
a contact with OpsAdmin stored in the database gets 403 downloading a log file.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/AyaNova/biz/NotifyEventHelper.cs

@@ -75,8 +75,8 @@ namespace AyaNova.Biz
         //case 4712: object events (created, modified, deleted, age) go only to subscribers with read rights on that type
         private static async Task<bool> SubscriberMayReadAsync(AyContext ct, long userId, AyaType aType)
         {
-            var roles = await ct.User.AsNoTracking().Where(z => z.Id == userId).Select(z => z.Roles).FirstOrDefaultAsync();
-            return AyaNova.Api.ControllerHelpers.Authorized.HasReadFullRole(roles, aType);
+            var u = await ct.User.AsNoTracking().Where(z => z.Id == userId).Select(z => new { z.UserType, z.Roles }).FirstOrDefaultAsync();
+            return u != null && AyaNova.Api.ControllerHelpers.Authorized.HasReadFullRole(UserBiz.EffectiveRoles(u.UserType, u.Roles), aType);
         }
 
         public static async Task ProcessStandardObjectCreatedEvents(ICoreBizObjectModel newObject, AyContext ct)