WS9 PR 2: firm-visibility backend (access branches, visibility routes, firm library)

Enforce and expose the firm library on top of migration 20260728_02:

- lib/access.ts: firm branch added to checkProjectAccess, ensureReviewAccess,
  ensureDocAccess, listAccessibleProjectIds, filterAccessibleDocumentIds - an
  item is accessible when visibility='firm' AND organisation_id = the caller's
  org (resolved once via getUserOrganisationId, threadable, 42703-tolerant).
  Firm viewers are non-owners; project-scoped reviews inherit their matter's
  visibility; missing columns => firm branch silently absent (legacy fallback).
- projects/tabular overview RPC calls pass p_user_org_id; GET /projects/:id and
  /people route access through checkProjectAccess so firm viewers reach matters.
- lib/firmVisibility.ts (self-contained seam): owner flip (predicate-encoded,
  owner-only), admin revert (org-scoped cross-org exclusion), firm-library list
  (reuses the overview RPCs filtered to visibility='firm').
- Routes: PATCH /projects/:id/visibility, PATCH /tabular-review/:id/visibility
  (owner-only, orgless 403, project-scoped review rejected 400), admin
  GET /admin/firm-library + POST /admin/firm-library/:type/:id/revert (MFA),
  member GET /firm-library, GET /user/firm-members (displayName+email only).
  All flips best-effort audited firm_shared/firm_reverted.

Tests: 500 passed (442 baseline + 58 new: access matrix, firmVisibility predicate
atomicity + cross-org, and the four route suites). tsc clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>