Add GitHub team allowlisting for browser login

[stainlu]

Summary

• Add optional CRABBOX_GITHUB_ALLOWED_TEAMS / CRABBOX_GITHUB_ALLOWED_TEAM checks to browser login after the existing allowed-org membership gate.
• Accept comma-separated team slugs as team-slug for the selected org or org/team-slug for multi-org setups.
• Document the new Worker config and add regression coverage for allowed and denied team membership.

Verification

• npm run format:check --prefix worker
• npm run lint --prefix worker
• npm run check --prefix worker
• npm test --prefix worker
• npm run build --prefix worker
• node scripts/build-docs-site.mjs
• npm run check
• git diff --check