Introduce 'no-access' team role

### Description

**As an:** team owner

**I want to:** add a user to my team with 'no-access' as their team-level role

**So that:** I can use Granular RBAC to selectively enable access to applications, and not worry about them defaulting to having access if new applications are created

---

A usability gap has been identified with our Granular RBAC capability by customers:

A team contains multiple applications, each hosting its own dashboard. The team owner wants to provide access it certain dashboards for certain users. They can achieve that today by:
1. adding the user to the team
2. use Granular RBAC to customise the level of access on each application

If they create a new application, all users will default to having access until the granular RBAC settings are updated for each user to remove their access. This is a particular problem when the granular RBAC is managed by SSO groups; the user's RBAC settings are only updated when they log out and back in. So the user gains access to the new applications by default until they log out/in.

The proposal here is to introduce a new *team-level* role that is lower than 'dashboard' that blocks access to by default.

Adding a user to a team with no-access level will show them a placeholder similar to the `dashboard` user role - and only list dashboards that granular-rbac allows them to see.

### Requested by

- https://github.com/FlowFuse/accounts/issues/34
- https://github.com/FlowFuse/accounts/issues/746

Start by tracing the existing team-level roles, the dashboard placeholder behavior, and the Granular RBAC application access checks. Define the new no-access role so users see only dashboards explicitly allowed by Granular RBAC, including when new applications are created, and verify the behavior for SSO-managed team membership.

Written by the indexing model from the issue text.