Scope: wire the existing team handler (src/handlers/team.ts) into the membership model + enforce role gates (viewer = read-only, editor = manage settings, admin/owner = members/billing/delete).
Done when: roles are enforced server-side on every mutating route.