Add authorization helper for “company owner/admin can manage members”**

[JulienLouisSchneider]

Issue 6 — Add authorization helper for “company owner/admin can manage members”

Description

Centralize the rule: only company_owner (and optionally company_admin) can manage members of their own company.

Checklist

• Implement a function:

  • CanManageCompanyMembers(sub, companyId) bool (or returns error)

  • DB query: membership for sub must match companyId and role in allowed set

• Use it in future member-management handlers.

• Add unit tests:

  • owner allowed

  • admin allowed (if enabled)

  • member denied

  • different company denied

Acceptance Criteria

• Authorization decision is consistent and tested.

• All member-management endpoints (next issue) use this helper.