feat: workspace admin settings (channel-creation policy + default channels)

[emmpaul]

Summary

Introduce a workspace admin settings surface and its first two settings: who can create channels (split public/private) and default channels new members auto-join.

Today teams has only name/slug/is_personal — no settings columns. TeamController@update (and SaveTeamRequest) handle only name. ChannelPolicy@create currently lets any team member create.

Locked decisions (from grilling)

Who can create channels — split public/private

• Two enum-cast string columns on teams: public_channel_creation_policy and private_channel_creation_policy.
• New enum ChannelCreationPolicy: Members (default — preserves today's behavior) | Admins.
• ChannelPolicy@create gates on the requested visibility against the matching column.

Default channels

• is_default boolean on channels, toggled by admins (no pivot).
• #general is always a default in code (no row needed / not removable).
• Only public channels can be defaults.
• Applied on joining the workspace — both invite-acceptance and SSO/directory provisioning route through the same "add to default channels" step.
• Non-retroactive — adding a default does not sweep existing members in.

Storage / surface

• Columns live on teams (typed/queryable, matches the role-on-pivot idiom) — no JSON blob, no team_settings table.
• Settings rendered on the existing workspace admin page (teams/Edit.vue), Admin+ only, extending SaveTeamRequest + TeamController@update.

Acceptance criteria

• Migration adds public_channel_creation_policy, private_channel_creation_policy to teams and is_default to channels.
• ChannelCreationPolicy enum added (+ TypeScript transform).
• ChannelPolicy@create enforces the policy by visibility; existing "member can create" behavior preserved when set to Members.
• Admins can toggle is_default per public channel; UI reflects it.
• Workspace-join (invite + SSO) adds the new member to #general + all is_default public channels; existing members untouched.
• Settings editable on teams/Edit.vue, Admin+ gated; SaveTeamRequest validates the new fields.
• i18n for all copy (+ lang/fr.json).
• Docs: update docs/ self-hosting/reference if these become operator-facing toggles.
• Tests: policy blocks non-admin creation when set to Admins (public and private independently), default-channel auto-join on invite + SSO, non-retroactivity. 100% coverage.

Out of scope

• Message retention — carved into its own issue; it will add one more setting into this same surface.