[P1][Collaboration] Implement workspace members, invitations, roles, and permission-aware UI

[Ankit6149]

Parent epics

#63, #64

User problem

Cloud workspaces need collaboration without making every member an owner. Roles must control campaigns, assets, provider/connector settings, invitations, approvals, exports, and publishing consistently across web, API, jobs, extension, and MCP.

Scope

• Roles: owner, admin, editor, reviewer, and viewer, with a documented permission matrix.
• Invite by email or supported identity, pending/accepted/expired/revoked states, resend, and duplicate handling.
• Member list, role change, removal, transfer ownership, leave workspace, and last-owner safeguards.
• Server-side authorization service/policies consumed by repositories and application commands.
• Permission-aware navigation/actions with explicit read-only and unavailable reasons.
• Extension workspace targeting and MCP access reflect current membership.
• Audit events for invitation, acceptance, role changes, removals, and ownership transfer.

Acceptance criteria

• Every protected command is enforced server-side through the shared authorization policy.
• UI visibility/disabled state matches enforcement but is never the only boundary.
• Reviewers can comment/approve without editing where policy specifies; viewers remain read-only.
• Publishing, connector/provider settings, data export/delete, and member administration have explicit permissions.
• Removing a member invalidates future access and queued unauthorized actions while preserving a safe recovery state for local unsaved edits.
• Last-owner and ownership-transfer edge cases cannot orphan a workspace.
• Invitation tokens expire, are single-purpose, and do not reveal workspace data before acceptance.

Tests

Full role matrix, invite expiry/reuse, duplicate invite, removed member with open tab, extension pairing after removal, MCP authorization, ownership transfer, last-owner, archived workspace, and cross-tenant ID tampering.