Gateway Accounts via additive reduced member role and workspace-access additive role #25936

Problem

• organization-member bundles workspace ops (lifecycle, template apply, provisioner jobs, file upload, tasks, runtime support) with the membership signal itself.
• A lightweight user (authenticates + uses AI Gateway, no workspace ops) can only be modeled by stripping capabilities off a default account.
• That forces every seat count, UI gate, and future role to branch on user type.
• allPermsExcept(...) auto-grants new resources to org members. Latent footgun.

Solution

• Hoist the implicit elevation into a new role organization-workspace-access.
• Shrink organization-member to a true membership floor.
• Default user = member + organization-member + organization-workspace-access. Behavior unchanged.
• Lite Account = same user, elevation role omitted. AuthorizeContext(ActionCreate, ResourceWorkspace) fails naturally; no special-case branches.
• Future tiers (read-only AI viewer, agents-only) compose from the same primitives.
• Floor shrink gated by a startup-read experiment so the additive code lands in trunk before behavior changes in production.

RFC: PLAT-217.

_{Filed by Coder Agents on behalf of @Emyrk.}