fix(security): restrict billing portal access

[bokelley]

Summary

• require an active exact-organization owner or admin role before issuing Stripe Customer Portal sessions
• live-recheck WorkOS authorization at direct, Addie, invoice-lock, and checkout post-discovery boundaries to close cached-role and TOCTOU gaps
• preserve ordinary-member invoice and checkout intake while returning active-subscription responses without privileged portal URLs

Security impact

Stripe Customer Portal sessions can change payment methods, subscriptions, and cancellation state. Previously any organization member could obtain one directly or through Addie, invoice, and checkout paths. This change centralizes billing-manager authorization, fails closed for inactive/mismatched/revoked memberships, and keeps invite flows portal-free.

Validation

• 4,947 server unit tests passed; 30 skipped
• 49 focused billing authorization tests passed
• TypeScript build passed
• Semgrep: 0 findings across changed files
• git diff --check passed
• changeset protocol-scope check passed
• independent security review: CLEAN
• independent testing review: CLEAN

Database-backed billing portal assertions are included and will run in CI; the local environment did not provide DATABASE_URL.