Roles and pg_hba.conf: why psql gets in and the application is refused

An application role, a read-only backup role, and the file that decides the authentication method line by line.