The staff principal for a cfx-admin login: the admin user with this sub,
a cfx.to email and canShadowRead (so ACTIVE), matching adminUserId
when given; null for anyone else.
OptionaladminUserId?: stringThe verified token's email: the admin pool's own IdP asserts it.
Reads the admin auth tables, which the customer and bank dashboards and the email handler are granted; the
user-shadow:*test is shadowAccessSql.