feat(api): add workspace member management endpoints

- POST/PATCH/DELETE /api/workspaces/:id/members
- Role hierarchy enforcement (cannot manage above own role)
- Cannot remove last OWNER, cannot self-demote if sole owner
- DTOs: AddMemberDto, UpdateMemberRoleDto with class-validator
- Tests: controller + service specs pass

Refs: MS21-API-003

.mosaic/orchestrator/mission.json

@@ -65,5 +65,16 @@
       "completed_at": ""
     }
   ],
-  "sessions": []
+  "sessions": [
+    {
+      "session_id": "sess-001",
+      "runtime": "unknown",
+      "started_at": "2026-02-28T17:48:51Z",
+      "ended_at": "",
+      "ended_reason": "",
+      "milestone_at_end": "",
+      "tasks_completed": [],
+      "last_task_id": ""
+    }
+  ]
 }

.mosaic/orchestrator/session.lock

@@ -0,0 +1,8 @@
+{
+  "session_id": "sess-001",
+  "runtime": "unknown",
+  "pid": 2396592,
+  "started_at": "2026-02-28T17:48:51Z",
+  "project_path": "/tmp/ms21-api-003",
+  "milestone_id": ""
+}