Add member-scoped daemon access grants

[itsjustanks]

Summary

• add audited owner/operator/viewer grants from organization members to daemons
• show all daemons to organization managers and only assigned daemons to ordinary members
• add an access editor to the Daemons panel
• enforce organization scoping with composite foreign keys and transactionally recorded audit events

Security boundary

These grants are Hub directory and visibility policy. They intentionally do not claim native daemon enforcement: current Paseo pairing sessions still receive daemon-wide owner permissions. The UI names that limitation so a future access.manage principal-sync bridge can enforce the stored roles without changing the Hub model.

Verification

• npm run typecheck
• npm run lint
• npm run format:check
• npm run db:check
• npm run build
• focused daemon-access and typography tests
• PGlite migration coverage across provider application store, OAuth bind safety, and legacy upgrades

The full test command was also attempted locally; container-backed suites could not run because no container runtime was available, and one existing Slack socket timing test timed out. Non-container focused coverage for this change passed.