feat(members): offer the observer role on invite and role change - #2549

🟢 Confidence 10/10 · safe to merge. Only an info note on a positional lookup; the role list, picker and prompt text are pinned by new tests.
_{1 note · tests covered · risk medium}

Moves the observer role into Policy.assignableRoles so the Members page offers it in the invite picker, the row picker and the role-change prompt, and makes an unknown Clerk role key display as Observer. Safe to merge once the Clerk role exists in production.

• observer joins assignableRoles lowest first; clerkRoles is gone
• toOrgRole now maps an unknown key to org:observer
• Invite default stays org:member

Before merge

• Manual · Create org:observer (name "Observer", no system permissions, in the default role set) on the production Clerk instance
• Manual · Confirm production has no Clerk role keys beyond admin, member and engineer: any other key now reads, and resends, as observer

Findings

`const memberEntry = Arr.findFirst(Policy.assignableRoles, (entry) => entry.role === "member")`, and return `Option.getOrThrow(memberEntry)` from `entryOf`'s fallback.

_{cfd9725 · Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}