fix: use DO block to add team_id column if teams table has wrong schema

fix: rbac_migration — create teams table if schema.sql was skipped

Fix rbac_migration: upsert default team before channel FK insert

feat: RBAC foundation — workspaces, channels, role-based access