feat: granular project access for org members

[HarshMN2345]

Add support for assigning org members to specific projects with per-project roles (owner, developer, editor, analyst) rather than granting access to all projects in the organization.

• Add project-role helpers to billing store: isProjectSpecificRole, parseProjectRole, buildProjectRole, getRoleLabel, projectRoles
• Pass projectId to getScopes in project layout so project-specific members receive correct scopes inside their assigned projects
• Add owner-only guard on org settings page
• Load orgProjects alongside members in the members page load
• New projectAccessSelector component for inline project+role rows with duplicate-project prevention
• Invite and edit modals use radio toggle (All / Specific projects) with inline selector — gated to plans with supportsOrganizationRoles
• Members table shows per-project role badges for project-specific members
• roles.svelte accepts isProjectSpecific prop for contextual role descriptions

What does this PR do?

Test Plan

(Write your test plan here. If you changed any code, please provide us with clear instructions on how you verified your changes work.)

Related PRs and Issues

(If this PR is related to any other PR or resolves any issue or related to any issue link all related PR and issues here.)

Have you read the Contributing Guidelines on issues?

(Write your answer here.)

[greptile-apps]

Greptile Summary

This PR adds granular project access for org members, allowing admins to assign members to specific projects with per-project roles (owner/developer/editor/analyst) rather than granting access to all projects.

• Billing store helpers (isProjectSpecificRole, parseProjectRole, buildProjectRole, getRoleLabel) parse and build the project-{id}-{role} role format using lastIndexOf for deterministic parsing.
• Invite & edit modals gain a radio toggle (All / Specific projects) backed by the new ProjectAccessSelector component with duplicate-project prevention; both modals are migrated to Svelte 5 runes.
• Org home page adds a membership query to filter the project list for project-specific members; the project layout passes projectId to getScopes so those members receive correct scopes inside their assigned projects.

Confidence Score: 4/5

Safe to merge with awareness of two non-crash edge cases in project filtering and list truncation.

The core access-control and scoping logic is correct for all UI-driven paths. A member with both a general role and project-specific roles reachable via direct API would have their org home filtered to only the project-specific subset. The hard 100-project cap silently truncates larger organizations in both the table badges and the project selector.

src/routes/(console)/organization-[organization]/+page.ts and members/+page.ts

Important Files Changed

Filename	Overview
src/lib/stores/billing.ts	Adds project-role helpers; lastDash boundary check correctly rejects empty/missing projectId segments.
src/routes/(console)/organization-[organization]/+page.ts	Adds project-scoped filtering; omits the guard for members with mixed general + project-specific roles.
src/routes/(console)/organization-[organization]/projectAccessSelector.svelte	New component for per-project role rows with duplicate-project prevention via allSelected derived.
src/routes/(console)/organization-[organization]/createMember.svelte	Migrated to Svelte 5 runes; Query.limit(100) caps visible projects silently.
src/routes/(console)/organization-[organization]/members/+page.ts	Loads orgProjects alongside members; Query.limit(100) caps project list silently.
src/routes/(console)/organization-[organization]/members/edit.svelte	Migrated to Svelte 5 runes; initialization $effect has known plan-downgrade issue (previously flagged).

_{Reviews (6): Last reviewed commit: "fix: skip membership lookup for owners a..." | Re-trigger Greptile}