IhawuPrincipalResolver

Default PrincipalResolver: maps the current Authentication to an IhawuPrincipal:

• userId ← the principal username (or Authentication.getName);

• roles ← authorities prefixed ROLE_, with the prefix stripped;

• attributes ← the username plus any map-valued details.

Unauthenticated or AnonymousAuthenticationToken requests resolve to null (fail closed).