Allow authenticated users to create their first team

[alejandro-runner]

Summary

• allow authenticated non-admin users to create their first team when they have zero existing team memberships in the tenant
• keep existing full-admin behavior unchanged for team creation
• add tenant-aware membership count coverage in the user repository tests

Why

Synvya onboarding needs a newly authenticated restaurant owner to bootstrap their first team, then continue under the normal team-admin model.

Verification

• cargo fmt --all
• cargo test -p keycast_core --lib --no-run
• cargo test -p keycast_api --lib --no-run