feat(login): derive and prune hosted profiles from the caller's grants