feat(orgs): deepen Org/Workspace RBAC — role hierarchy, permissions, delete endpoints
- types.ts: add ROLE_HIERARCHY (owner>admin>member>viewer), ROLE_PERMISSIONS matrix (11 permissions),
hasPermission() and canManageRole() helpers
- repository.ts: add deleteMembership, getUserMembership, deleteOrganization, deleteWorkspace
- routes.ts: 4 new endpoints — DELETE /orgs/:id (owner only), DELETE /orgs/:id/workspaces/:wsId,
DELETE /orgs/:id/memberships/:mbrId (RBAC enforced), GET /orgs/:id/permissions
- RBAC enforcement: role update checks actor outranks target, cannot remove owner, cannot
assign role >= own level
- routes.test.ts: 6 new tests (8 total) — owner-only delete, member removal RBAC,
permissions endpoint, non-member handling
- repository.test.ts: 1 existing test unchanged
0195cde1c0