refactor: move project member mutations into membership package

cmd/serve.go

@@ -434,7 +434,7 @@ func buildAPIDependencies(
 	projectService := project.NewService(projectRepository, relationService, userService, policyService,
 		authnService, serviceUserService, groupService, roleService)
 
-	membershipService := membership.NewService(logger, policyService, relationService, roleService, organizationService, userService, projectService, groupService, auditRecordRepository)
+	membershipService := membership.NewService(logger, policyService, relationService, roleService, organizationService, userService, projectService, groupService, serviceUserService, auditRecordRepository)
 	// Setter injection: org → membership is circular (membership needs org for validation,
 	// org needs membership for Create/AdminCreate). Break the cycle with a post-init setter.
 	organizationService.SetMembershipService(membershipService)

core/membership/errors.go

@@ -9,4 +9,6 @@ var (
 	ErrLastOwnerRole        = errors.New("cannot change role: this is the last owner of the organization")
 	ErrInvalidPrincipal     = errors.New("only user principals are supported")
 	ErrInvalidPrincipalType = errors.New("unsupported principal type")
+	ErrNotOrgMember         = errors.New("principal is not a member of the organization")
+	ErrInvalidProjectRole   = errors.New("role is not valid for project scope")
 )