[WPB-23995] app visibility accross teams

[fisx]

Checklist

• Add a new entry in an appropriate subdirectory of changelog.d
• Read and follow the PR guidelines

[Copilot]

Pull request overview

This PR prevents app users from creating/being part of user connections across teams by adding an explicit “no apps in connection creation” guard, and it adds an integration test covering cross-team (and optionally cross-domain) scenarios.

Changes:

• Add ensureNoApps guard and apply it to local + remote connection creation paths.
• Move ensureNotSameTeam into Brig.API.Connection.Util and reuse it from Brig.API.Connection.
• Add an integration test covering cross-team conversations involving apps; add a changelog entry.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
services/brig/src/Brig/API/Connection/Util.hs	Introduces ensureNoApps (and exports ensureNotSameTeam) to enforce connection preconditions.
services/brig/src/Brig/API/Connection/Remote.hs	Applies ensureNoApps to remote connection creation and updates effect constraints/imports.
services/brig/src/Brig/API/Connection.hs	Removes inline ensureNotSameTeam and applies ensureNoApps to local connection creation.
integration/test/Test/Apps.hs	Adds a cross-team app conversation integration test.
changelog.d/3-bug-fixes/WPB-23995-app-visibility-accross-teams	Documents the behavior change in the changelog entry.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[blackheaven]

copilot lints seem legit