[Team] Enforce owner-scoped access to bot resources #49

Planning ID: TODO-D

Proposed issue / PR title: feat(authz): scope bot resources and administration to their owner.

Goal: authenticated users cannot access each other’s private agent resources.

Scope: central authorization helpers for roster mutations, private history, settings, memory, files, secrets, approvals and relevant subscriptions. Replace unrestricted Main Bot management with owner-scoped authority. Keep team administrative actions separate. Audit every existing endpoint that exposes these resources.

Out of scope: cross-owner messaging and a full filesystem sandbox redesign.

Dependencies: TODO-B (#47), TODO-C (#48).

Code area: channel, roster, memory, secrets, capabilities, history and approval handlers; plugin API exposure.

Acceptance and tests: owner can use existing features; a different member or their bot cannot access them by changing IDs, using alternate endpoints or subscribing directly. Team admin has no implicit private-secret access. Execution credentials/resources that cannot be isolated in the chosen deployment are explicitly blocked from shared use, not hidden only in the UI.

Delivery

One focused implementation PR for this issue. This is planned work, not a claim of shipped multi-human support. Preserve the pristine upstream pin and generated patch/client boundaries. Keep team mode disabled until the documented authorization gates pass. Record exact tested head, executed checks, missing checks and independent review. No production credentials or live deployment are part of this issue.