the configured value; blank/undefined means "no preference", not an error
short label for the setting being resolved (e.g. 'MagicLink'), used both in
the operator-facing message and to key de-duplication
the principal to act as, or null when this deployment offers none — callers MUST handle null rather than assume a principal is always available
Resolves the principal named by a config setting, reading the process-wide user cache.
The impure shell over resolvePrincipalFrom: it supplies the cache and owns log volume.