security(teams): authorize /teams from the session, not the global users.role_id (#830)

[alex-dembele]

Closes #830

Decision (criterion 1): kept and fixed, not removed

/teams has no UI, no OpenAPI entry and no product claim, and it had never worked: every call returned 404. Removing a module would be a product decision, and the issue allowed either outcome. So this PR repairs it along criteria 2 to 4. If you'd rather drop the module, that is a separate, small PR: delete the 7 routes and the handler. The tables stay, so no migration is needed.

What changed (internal/handler/team_handler.go)

• The seven in-handler currentUser.Role.Name != "admin" checks are removed (criterion 2). They read the global users.role_id, and they looked the caller up by claims.ID (the JWT id) instead of claims.Sub, which is why everything returned 404. Authorization is the RequireRole("admin") route guard, which reads the caller's role in the active organization.
• AddTeamMember requires an active membership in the caller's tenant (criterion 3). A foreign user, a withdrawn member, an unknown id and a malformed id all get the same 404 {"error":"User not found"}. Before, a malformed id could reach uuid.MustParse.
• DeleteTeam removes the members and the team in one transaction (rule 7).
• Team and member ids are set with uuid.New() instead of relying on the Postgres-only gen_random_uuid() default.

Verification

$ go test ./internal/handler/ -run 'TestTeam' -count=1 -v
--- PASS: TestTeams_Success
--- PASS: TestTeams_NotFound
--- PASS: TestTeams_Unauthorized
--- PASS: TestTeam_TenantIsolationPredicate
ok  	github.com/opendefender/openrisk/internal/handler	0.087s

All three new tests fail against the old handler.

$ go test ./internal/security/... ./internal/handler/... ./internal/service/... ./cmd/... -count=1
ok internal/security/isolation · ok internal/security/routes · ok internal/handler · ok internal/handler/auth · ok internal/service · ok cmd/server

The DoD grep grep -rn 'Role.Name != "admin"' internal/handler/ now returns only the four hits in user_handler.go. PR #832 (#807) removes those, so the grep is empty once both are merged.

Honest remainders

• The tests run on SQLite. No live Postgres pass for /teams.
• GetTeam still loads each member's user row one query at a time (N+1). It existed before this PR and is untouched, because this is a security fix.