The host that brands the bank's sign-in page; no part of choosing a tenant.
Whether the bank's dashboard is open to its members.
The bank the caller last acted in (BankDashboardUserService.markSeen).
The role's keys in code-unit order; none without a role, for a refused internal role, or when not ACTIVE.
0 without a role, with an internal role that grants nothing, or when not ACTIVE.
last_seen_at is within the markSeen throttle, so a same-bank mark would write nothing.
The bank's dashboard workspace, by its public bws_… id.
One of the caller's own memberships, whichever bank it is in.