fix(auth): require platform admin for platform-level mutations

[atbagan]

Problem

auth.AdminMiddleware (internal/auth/middleware.go:431) is RequireAdmin, which passes any user who is an admin of any team (UserSession.IsAdmin, session.go:299). It gated the /api/admin write group, platform provider CRUD, management addon and GitOps mutations, and Git provider config (router.go:320,332,396,485,542). A team admin could create users, edit identity providers, network pools, policies, the platform config, and add or remove members of teams they do not administer. Found in the 2026-08 parity audit (H15, D5).

Change

• Platform-level mutation groups now use auth.RequirePlatformAdmin() (previously defined, never wired).
• Team member and group-sync routes stay behind the any-team-admin middleware, and the six handlers check IsAdminOfTeam(name) through authorizeTeamMembershipChange, so an admin of team A cannot edit team B.
• GET /admin/config and GET /admin/audit move to the platform-viewer tier of the /admin group; AuditHandler.ListAll accepts platform viewer or above instead of platform admin only. GET /admin/observability/status stays admin-only because the handler writes ButlerConfig.
• Comments on the affected groups say which tier applies.

Verification

• CGO_ENABLED=0 go build ./..., go vet ./internal/api/... clean
• CGO_ENABLED=0 go test ./... passes; teams_membership_authz_test.go covers nil session, platform admin, platform viewer, own-team admin, other-team admin, and mixed memberships.
• Callers: console admin pages run as platform admin; the portal proxy session is the legacy platform admin, so nothing changes for it. The /admin route already required platform viewer or above before this change, so no currently working caller loses access.

Depends on

#92 (team create/update/delete gates). Independent files except the /admin/teams lines in router.go; merge either order.

Out of scope

Observed while here: the whole /api/admin route requires platform viewer or above, so a team admin without a platform role cannot reach /api/admin/teams/{t}/members at all, which is what the console TeamMembersPage calls. That is pre-existing and worth a product decision (team-scoped member management outside /admin). The UpdateMemberRole handler still allows promoting to admin without restriction; unchanged here.