feat: enforce team private user identity

[wbugitlab1]

Summary

• adds per-request team userId resolution with AGENTMEMORY_USER_ID fallback
• enforces TEAM_MODE=private filtering for team feed/profile and routes the MCP team profile resource through the same function boundary
• whitelists REST/MCP team payload fields and documents the multi-user team behavior

Fixes #511.

Verification

• corepack pnpm exec vitest run test/team.test.ts test/config-resolve.test.ts test/mcp-server-surface.test.ts test/api-boundary-coverage.test.ts test/plugin-surface-contract.test.ts --exclude test/integration.test.ts
• corepack pnpm run lint
• corepack pnpm run build
• git diff --check refs/remotes/origin/main...HEAD
• corepack pnpm test
• semgrep scan --config p/default --error --metrics=off .
• gitleaks protect --staged --redact