Introduce core/membership package that manages policy + relation
together for org membership operations. AddOrganizationMember
validates org/user/role, creates policy + explicit relation, and
emits audit records.

- Validates org exists and is enabled, user exists and is enabled,
  role is org-scoped (global or org-specific)
- Rejects if user is already a member
- Creates policy and matching explicit relation (owner role -> owner
  relation, everything else -> member relation)
- Audit logging via both structured records and event auditor
- 12 unit tests covering all error and success paths

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

If createRelation fails after createPolicy succeeds, attempt to
delete the orphaned policy. Log a warning if the cleanup also fails
so the orphan can be investigated.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Validate principalType is app/user before any service calls. Prevents
invalid membership data if a caller passes a serviceuser or group
principal type.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Wire the membership package into the AddOrganizationMembers AdminService
RPC. Batch endpoint accepts list of {user_id, role_id} pairs and returns
per-member success/error results.

- Handler iterates members, calls membershipService.AddOrganizationMember
- Domain errors (already member, invalid role, etc.) returned as-is
- Internal errors masked with generic message and logged server-side
- Authorization: IsSuperUser (AdminService)
- Proto regenerated from proton branch with new RPC

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Rohil pointed out that the previous check let custom roles created
for an org pass even if they weren't scoped to the org namespace.
Now we check schema.OrganizationNamespace scope first, before
deciding if the role is platform-wide or org-specific.

Also remove stale 'replacePolicy deletes...' comment on createPolicy.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>