Extracts the aibridge_interception create/update grants out of the site member role and the organization-member/service-account floors into a new built-in org role, organization-ai-gateway-access, and enforces it at the AI Gateway.

Role extraction

• The new role carries only member-scoped aibridge_interception: create, update. It is appended to organizations.default_org_member_roles by migration (idempotent) and to rbac.DefaultOrgMemberRoles() for new organizations, so existing members keep AI Gateway access with no behavior change by default.
• Interception RBAC objects are now scoped to any organization (AnyOrganization().WithOwner(initiator)) so the member-scoped perms authorize holders in any org they belong to. Org admins are explicitly excluded from the org-level aibridge grant, preserving the invariant that only site-wide auditors and owners can read interceptions.
• The Edit Roles UI gains descriptions for organization-workspace-access and organization-ai-gateway-access.

Enforcement

aibridgedserver.IsAuthorized previously validated only the API key and user status; interception recording happens under the aibridged system subject, so the initiator's own permissions were never consulted. Now the initiator must be authorized to create an AI Bridge interception or the request is rejected with ErrNoAIGatewayAccess (HTTP 403). The check expands the user's roles (including custom roles) and evaluates with the API key's scope set, so restricted-scope tokens cannot route AI traffic unless their scope carries the interception create permission. rolestore.Expand now accepts a narrow store interface so the aibridged server's store can satisfy it.

Seat recording

Under the permission-based-licensing experiment (introduced in #27279), RecordInterception no longer records ai_seat_state usage for the initiator: AI Gateway access is licensed by the AI Governance add-on and gated by the role rather than per seat. Task workspace builds still claim AI Governance seats.

Part of the gateway-accounts exploration.

Stack

Part 2 of the gateway-accounts stack. Each PR builds on the previous:

1. feat: count only workspace-capable users toward license seats #27279: permission-based license seat counting. Behind the permission-based-licensing experiment and gated on the AI Governance add-on, user_limit counts only users the RBAC engine authorizes to create workspaces.
2. feat: add organization-ai-gateway-access role and enforce it at the AI Gateway #27280 (this PR): adds the organization-ai-gateway-access org role carrying the AI Bridge interception permissions (extracted from the member floors, backfilled into org default roles by migration) and enforces it at AI Gateway authentication; bridge usage stops claiming AI Governance seats under the experiment.
3. feat: gate workspace ACL grants on a use_shared capability #27281: adds a use_shared capability precondition for workspace ACL grants, so workspace sharing is ineffective for (and rejected toward) users without workspace capabilities, evaluated live on every authorization.

Related but independent: #27278 hides the Workspaces page create CTAs for users without workspace-create permission.