feat(client,mcp): teammate_groups vertical (RBAC)

[dougborg]

Summary

Build a client.teammate_groups helper + MCP tools covering Front's
RBAC teammate-group surface (14 endpoints, the largest mutation
surface in the workspace-admin umbrella).

Status

Deferred — filed as part of the #16 workspace-admin partition.
Teammate groups are RBAC primitives — admins use them to define
permission boundaries (which inboxes a group of teammates can see, etc.).
Agents don't operate on RBAC. Pick up if a concrete agent use case
emerges around access management.

Scope

• Tag: teammate_groups (14 modules, all company-scoped).
  • Reads: list_company_teammate_groups / get_company_teammate_group /
    list_company_teammate_group_teammates /
    list_company_teammate_group_teams /
    list_company_teammate_group_team_inboxes
  • Mutations: create_company_teammate_group /
    update_a_company_teammate_group /
    delete_company_teammate_group /
    add_company_teammate_group_teammates /
    add_company_teammate_group_teams /
    add_company_teammate_group_team_inboxes /
    remove_company_teammate_group_teammates /
    remove_company_teammate_group_teams /
    remove_company_teammate_group_team_inboxes
• Helper hides the _a_ infix on update_a_company_teammate_group.
• All mutation tools gated with confirm_or_preview.
• Tests + docs.

Path quirk

• update_a_company_teammate_group carries the _a_ infix; the
  helper exposes update(group_id, ...).
• Three sub-resources (teammates / teams / team-inboxes) each have
  list / add / remove endpoints — naturally three method clusters
  on the helper.

Umbrella

Part of #16 (workspace admin partition). Tier 3.