Add scope-based model allowlists

[websideofamir]

Summary

• add a deployment-owned model allowlist keyed by QM scope IDs
• resolve access as organization models plus exactly one active scope
• enforce scoped defaults and direct model requests across web, Slack, and runtime dispatch
• add an administrator-only project instructions editor backed by existing durable SOUL

Policy behavior

Defaults resolve in this order:

1. active scope default
2. organization default
3. first effective allowed model

Personal, team, channel, and group grants never follow an actor into another scope. Custom-provider registration and credentials are unchanged.

Validation

• focused Core model, runtime, turn, capability, project, and SOUL tests
• Web UI test suite: 501 passed
• root TypeScript typecheck
• focused ESLint and Prettier checks
• Web UI production build
• live Firefox QA against a production-shaped dev instance

The full root test command had three unrelated existing failures in OpenCode startup output, dependency lock materialization, and inherited pager environment. Contract typecheck also cannot resolve the workspace's @yc-software/qm/contract package.

Screenshot

Synthetic local project data in Firefox:

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}