Add the Service Account account type

Phase 2 — The principal.

Today
Two account types, individual and organization. Roughly 48 places across 20 files branch on which.

Do

• Add AccountType.SERVICE.
• Add an explicit owner_account_id and an index for it.
• Mint ids in a reserved svc-- namespace (ID_REGEX forbids -- in a human-chosen id, so the prefix cannot be forged).
• Restrict a service account to read_data / write_data memberships — never owners or maintainers.

Done when

• A service account can be created.
• It appears on the two membership-management pages, visually distinguished, since that is where an owner revokes its grant.
• It cannot be invited as owner or maintainer, cannot create products or organizations, and cannot hold the admin flag.

Watch

• The default at every branch site is exclude; inclusion needs a reason.
• Most of those sites are the binary isIndividualAccount / isOrganizationalAccount helpers, which would render a machine as an organization profile rather than failing.
• Membership listing currently returns false for any third account type and must be widened for exactly those two pages.
• An account id is also the first segment of a public URL, so each service account consumes a name and gets a profile route.

Open question carried from the epic: what "capped by the owner" means when the owner is an organization — which is also the recommended default. Organizations never authenticate, and the membership lookup returns rows where the organization is the member, which is not the same thing.

Depends on source-cooperative/source.coop#543 and source-cooperative/source.coop#544.

Part of source-cooperative/source.coop#491.

Start by tracing the isIndividualAccount and isOrganizationalAccount helpers across the stated branch sites, then inspect ID_REGEX, membership listing, and the two membership-management pages. Confirm how account creation, ownership, invitations, product and organization creation, admin flags, and public profile routes handle the new type. Done means service accounts use the reserved namespace, have the stated ownership and membership limits, and appear correctly on both pages.