fix(auth): restore team-scoped authorization

[roodboi]

Motivation

• A recent change made listTeams() and getTeam() authorize on organization membership which allowed any active org member to administer every team in that org, widening privileges unintentionally.
• The goal is to restore team-scoped authorization so only users with an active membership on a specific team can list or administer that team.

Description

• Restores listTeams() to require an active team-scoped membership for the acting user when deciding which teams to return instead of authorizing on organization membership.
• Restores getTeam() to require an active team-scoped membership for the acting user for team access instead of checking organization membership.
• Updates the regression test (org-team-membership.test.ts) to assert that org-only members cannot list or add members to teams they do not belong to.

Testing

• Attempted to run the test suite with bun test services/auth-broker/tests/org-team-membership.test.ts, but the run could not be executed because bun is not installed in the current environment and therefore the tests could not be executed here.
• Attempted to run format/lint checks with bun x ultracite check services/auth-broker/src/modules/orgs/service.ts services/auth-broker/tests/org-team-membership.test.ts, but this also failed due to bun not being available in this environment.
• The change is minimal and focused to restore previous authorization semantics; please run bun test and bun x ultracite fix/bun x ultracite check in CI or locally to validate before merging.

---

Codex Task

[changeset-bot]

⚠️ No Changeset found

Latest commit: 3c4eee5

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR