Allow org members to create and manage their own MCP connections (not admin-only) #66

Problem

Org members can't create or manage their own MCP connections. mcpConnections.create (and mcpConnections.list) return 403 OrganizationForbidden unless the caller is an org admin.

Incident

During a Latitudes Mesh automated join (join e359f09e-3524-4751-813f-5ee386b92184, Poteto seat) on executor-v2.shuv.dev:

• The joining user's role was member.
• Earlier steps worked as a member: join.begin, appAccounts.userConnect and accounts.submit created the peer account and seat.
• Step 3 of the Mesh mesh-setup recipe, mcpConnections.create for the dedicated Mesh · Poteto connection, failed with 403 OrganizationForbidden.
• The workaround was promoting the user to org Admin, after which the create succeeded.

Several more peers still have to join the same way, and making every joining user an org admin is too broad.

Proposal

Let members create, list, update and revoke their own MCP connections, scoped to:

• apps they can see, and
• runsAs accounts they own.

Keep org-wide connection management, and other members' connections, admin-only. Consider the same for mintKey/revokeKey on connections the member owns.

Notes

• Follow-up only. Do not implement yet; to revisit after the current Mesh joins.
• Related: Mesh mesh-setup assumes the signed-in user can create the dedicated connection.