feat: update authz descriptions + add BlueprintMembershipType for dynamic entity types

[pyramation]

Summary

Two changes to the node type registry to support dynamic entity types:

1. Authz description updates — Updates the membership_type parameter description across all 5 authz node type definitions from "3=group" to "3+=dynamic entity types". This reflects that membership types ≥3 are no longer hardcoded as "group" — they are now dynamically registered entity types (data rooms, channels, departments, etc.) provisioned via membership_types_module.

2. New BlueprintMembershipType interface — Adds the TypeScript type for the membership_types[] array in BlueprintDefinition, matching the JSONB shape that construct_blueprint() Phase 0 reads from entity_type_provision. This was missing — the SQL procedure already supported it but the TS types didn't expose it.

export interface BlueprintMembershipType {
  name: string;              // e.g., "data_room", "channel"
  prefix: string;            // e.g., "dr", "ch"
  description?: string;
  parent_entity?: string;    // DEFAULT 'org'
  table_name?: string;
  is_visible?: boolean;      // DEFAULT true
  has_limits?: boolean;      // DEFAULT false
  has_profiles?: boolean;    // DEFAULT false
  has_levels?: boolean;      // DEFAULT false
  skip_entity_policies?: boolean; // DEFAULT false
}

Files changed (source):

• authz-membership-check.ts — description update
• authz-entity-membership.ts — description update
• authz-peer-ownership.ts — description update
• authz-related-entity-membership.ts — description update
• authz-related-peer-ownership.ts — description update
• codegen/generate-types.ts — new buildBlueprintMembershipType() function + wired into buildBlueprintDefinition() and buildProgram()

Regenerated: blueprint-types.generated.ts via pnpm generate:types

Companion to constructive-db PR #813 which renames create_group/admin_group/create_organizations → create_entity/admin_entity in the SQL generators and test files.

Review & Testing Checklist for Human

• Verify BlueprintMembershipType fields match the SQL — compare the interface fields against the INSERT INTO entity_type_provision in construct_blueprint() (procedure.sql). Any mismatch means blueprints built with this type would produce invalid JSONB.
• Regenerate and diff — run cd graphql/node-type-registry && pnpm generate:types locally and confirm the output matches blueprint-types.generated.ts exactly (no manual edits crept in).
• Grep for 3=group — confirm no other files in the repo still reference the old description.

Notes

• No logic changes — the authz updates are purely documentation strings in JSON schemas and their generated TypeScript type comments.
• The BlueprintMembershipType is a static type definition (not introspection-driven) since entity_type_provision is a provisioning table, not a regular _meta-exposed table.
• After this merges, the node_type_registry seed SQL in constructive-db should be regenerated so the deployed DB seed reflects the updated descriptions and new type.

Link to Devin session: https://app.devin.ai/sessions/61be2d8e471048e294178e4a95d7e9dc
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring