Segment membership refresh API

[khvn26]

Scope

• POST /api/v1/environments/{id}/membership/refresh enqueues a full backfill task for the env, going through Segment membership backfill lifecycle #7407's enqueue guard.
• Translates the enqueue-guard sentinel into a 429 response.
• Same RBAC gate as the read API.

Acceptance criteria

• 202 with last_backfill_started_at returned when the refresh enqueues.
• 429 when the enqueue guard blocks (concurrent backfill running, or within the cooldown window of a previous completion).
• 403 when the user lacks env identity view permission.