Challenge creation checks only host team membership, not status or permissions

Hi maintainers,

I noticed that challenge creation currently checks only host team membership,
not host status or permissions.
While tracing this flow, I also observed that the host team listing endpoint
returns all teams associated with a user without filtering by status or
permissions. Because of this, it seems possible for a user with a non-ACCEPTED
status or non-ADMIN/WRITE permission to access a host team ID and pass the
membership check.
Is this behavior intentional, or should permission checks (e.g. status=ACCEPTED
and permissions in [ADMIN, WRITE]) be enforced at the API level? I might be
missing some context, but happy to work on this if a backend-side check is
desired.

Trace the challenge creation API flow and the host team listing endpoint described in the issue. Check how host team membership currently handles status and permissions, then verify whether non-ACCEPTED members and non-ADMIN/WRITE permissions can pass the check. Done means the API behavior consistently enforces the intended status and permission rules, with tests covering both endpoints.

Written by the indexing model from the issue text.