Handle {:ok, user}, {:ok, nil} in addition to {:ok, [user]}, {:ok, []}.
Register and sign-in call apply_admin_role_from_user_info; users in configured admin group get Admin role, others get Mitglied. Internal User action + bypass policy.
