fix(admin): let project MANAGE holders list teams for grants

GET /teams was org-admin only while team-access mutations require project
MANAGE, so members with MANAGE saw an empty grant picker. Open the
read-only team list to any org member and load it in the project page
whenever the actor can manage the project.

hub/src/admin/routes/teamsRoutes.ts

@@ -18,10 +18,16 @@ export async function registerTeamsRoutes(
 ): Promise<void> {
   const guardDeps: GuardDeps = { prisma: config.prisma, sessionSecret: config.sessionSecret };
 
+  // Read-only listing is open to any active org member so project MANAGE
+  // holders can pick a team when granting TEAM→PROJECT access (ADR-0004).
+  // Mutations below stay org-admin only.
   app.get("/api/org/:orgSlug/teams", async (request, reply) => {
     try {
       const { orgSlug } = request.params as { orgSlug: string };
-      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      const auth = await requireOrgRole(request, reply, guardDeps, {
+        orgSlug,
+        roles: ["OWNER", "ADMIN", "MEMBER"],
+      });
       if (auth === null) return;
       return { teams: await listOrgTeams(config.prisma, auth.organization.id) };
     } catch (err) {