[Story]: Scoped-admin roles

## Summary
Add scoped-admin roles that grant administration rights over a specific org subtree (e.g. a BU's admin can manage their own teams and members) without platform-wide access.

## Intent / Source of truth
Buyers expect delegated administration so a BU doesn't need platform-team involvement for routine changes. Part of [Epic] Organization hierarchy and delegated administration.

## Scope
- [ ] Scoped-admin role definition bound to an org-tree node
- [ ] Authorization checks rejecting actions outside the admin's subtree
- [ ] Audit logging distinguishing scoped-admin actions from platform-admin actions

## Out of scope
- Fine-grained per-action permission toggles within a scope (tracked under the RBAC epic if needed)

## Verification
Test asserting a scoped admin's API calls against a sibling subtree are rejected with 403; audit log correctly attributes scoped-admin actions.

## Risk assessment
A privilege-escalation bug here (scoped admin reaching outside their subtree) is a severe security regression; needs dedicated negative-path tests, not just happy-path coverage.

## AI Usage Declaration
Drafted with AI assistance during the 2026-08-13 cross-repo backlog consolidation and enterprise-readiness research. A human owns intent, verification and consequences.