[Fix] Prevent members from rewriting deployment environments

[roomote-community]

Created by Roomote. Follow up by mentioning @roomote, in the web UI, or in Discord.

What changed

• Require an active deployment admin for MCP environment create and update requests.
• Resolve task-run writes against the current live acting user and fail closed when the run binding is missing, malformed, or cannot be loaded.
• Cover direct users and task-run actors across admin, member, deleted-user, and missing-run authorization cases.

Why this change was made

The web Settings path already required admin access, but the MCP environment write path accepted any resolvable user. That allowed deployment members to create or replace shared environment definitions.

Impact

Only active admins can create or update deployment environments through MCP. Existing administrator-driven environment setup remains supported, while member and invalid run-token writes now receive a 403 before request processing or data access.

The focused environment authorization suite and API typecheck pass. The API package-wide ESLint command is still blocked by five pre-existing warnings in unrelated Discord and GitHub tests; the repository pre-push oxlint, fast typechecks, residual lint, and knip checks pass.

[roomote-community]

No code issues found. See task

_{Reviewed 188525d}