fix: harden admin access management in org auth routes

[evrendom]

Summary

This is a backend-only hardening change for organization membership management.

It adds an explicit admin-access policy in the API layer and applies it before Better Auth handles membership mutations. The goal is to keep admin privilege changes owner-only without relying on frontend behavior.

What changed

• added a small policy module to keep the admin-access rule explicit and easy to read
• enforced that policy before Better Auth handles org membership mutations
• covered add-member, invite-member, update-member-role, remove-member, and cancel-invitation
• added focused tests for promotion, demotion, removal, and admin-invite cancellation

Behavior

Non-owners are now blocked from:

• assigning the admin role
• demoting an existing admin
• removing an admin member
• canceling an invitation that grants admin access

Owners keep existing admin-management behavior.

Frontend behavior is unchanged. This is enforced on the backend.

Testing

• bun test src/__tests__/organization-role-policy.test.ts