* feat: add per-member canViewPayloads for payload visibility

Allow tenant OWNER/ADMIN to hide run and event payloads from specific members without 403ing the request.

* chore: regenerate TypeScript SDK REST bindings for canViewPayloads

* chore: regenerate Python and Ruby SDK REST bindings for canViewPayloads

* fix: keep additional metadata visible when payloads are restricted

Payload stripping should only hide input, output, and event payloads, not run or event additional metadata.

* chore: note

* fix: sync generated payload comments and prettier

* fix: drop org-member payload visibility from team settings

Org members are not fanned out to tenants, so the flag belongs on tenant membership and user groups only.

* docs