Rewrite the listener onboarding, the role row, and the fail-closed law: the claim grants every signer, revocation happens on the ABS side (disable or delete the user), and what actually guards the library is who can reach the audiobookshelf application in authentik. Name both e2e gates in Verification.