add invite-link authorization capabilities

[GregorShear]

Description:

Adds fine-grained authorization for invite-link operations:

• Introduces QueryInviteLinks and DeleteInviteLink capability bits and includes them, together with the existing CreateInviteLink bit, in TeamAdmin.
• Gates invite-link list, create, and delete operations with their corresponding bits.
• Adds a typed authorizationScope to the invite-link connection. Its effective prefixes are the same values bound into the SQL query, so clients can distinguish an authorized empty result from no authorized scope.
• Regenerates the checked-in GraphQL SDL.

Workflow steps:

GraphQL clients can request:

inviteLinks {
  authorizationScope {
    allOf
    effectiveCatalogPrefixes
  }
  edges {
    node {
      token
    }
  }
}

Legacy admin grants continue to work because the Admin bundle includes TeamAdmin.

Documentation links affected:

None.

Notes for reviewers:

This is the base PR in a two-PR stack. The child PR standardizes structured authorization-denial errors.

Validation:

• cargo check -p control-plane-api
• cargo test -p tables (37 passed)
• cargo test -p flow-client
• cargo build -p flow-client --features generate
• git diff --check