feat: owner read-only view-as from team users table

Allow org owners to inspect any member's data scope via dual JWT; server blocks mutations and team page stays reachable for return.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/src/auth/auth.module.ts

@@ -1,4 +1,5 @@
 import { Module } from '@nestjs/common';
+import { APP_INTERCEPTOR } from '@nestjs/core';
 import { JwtModule } from '@nestjs/jwt';
 import { PassportModule } from '@nestjs/passport';
 import { ConfigModule, ConfigService } from '@nestjs/config';
@@ -8,6 +9,7 @@ import { AuthService } from './auth.service';
 import { AuthController } from './auth.controller';
 import { JwtStrategy } from './jwt.strategy';
 import { RolesGuard } from './roles.guard';
+import { ViewAsReadOnlyInterceptor } from './view-as-readonly.interceptor';
 import { SmsService } from '../common/sms.service';
 
 @Module({
@@ -28,7 +30,16 @@ import { SmsService } from '../common/sms.service';
     }),
   ],
   controllers: [AuthController],
-  providers: [AuthService, JwtStrategy, RolesGuard, SmsService],
+  providers: [
+    AuthService,
+    JwtStrategy,
+    RolesGuard,
+    SmsService,
+    {
+      provide: APP_INTERCEPTOR,
+      useClass: ViewAsReadOnlyInterceptor,
+    },
+  ],
   exports: [AuthService, RolesGuard, JwtModule],
 })
 export class AuthModule {}