Requires the authenticated principal to hold any of the given roles. May be applied at the class level (default for all routes) or method level (overrides the class default).

Enforced by DecoratorPlugin unless enforceRoles: false: the route's chain gets middleware that answers 401 without a principal, 403 when the principal holds none of the roles, and — when no authorization provider is registered at all — 501 (fail closed, with a startup warning naming both remedies).