refactor: Enforce per-org RBAC via organization member roles

[m-t-a97]

Make organization_members.role the single source of truth for tenant permissions, closing the cross-tenant privilege escalation (BOLA/IDOR) vectors in the organizations and api-key plugins.

• Access control service: add GetRolePermissionsByName/GetRoleWeightByName; remove ValidateRoleAssignment from the interface.
• Org auth: export AuthorizeOrganizationAccess and enforce organization_id claim equality for machines and users; fail closed when no member row exists.
• Org use cases: authorize per-request via the actor's membership role permissions (wildcard-aware) or token scopes for machine actors.
• Purge org handlers' writes to global access_control_user_roles; keep the assign-role hook for platform-level use only.
• Member/invitation writes are machine-forbidden and gated by role weight (heavier target => 403, missing target => 400); RemoveMember gains weight and owner-protection guards.
• Add RequireActor(ActorUser) to member/invitation write routes.
• api-key: org-owned key Create/Update require the requester's membership in the org and requested key perms to be a subset of their per-org perms.
• Tests: coverage for claim binding, per-role permission gating, machine restrictions, RemoveMember guards, and the new access-control methods.