feat(fp): WP-23 — org-template backend + admin role

Second template axis (org identity: letterhead, footer, signature,
margins) server-side: OrgTemplateStore with JSON version history,
publish/rollback, sent-brief version pinning, admin role + capability,
5 admin endpoints, org-logo upload category. FE seam widened only
(Role/Capability unions, interceptor); WP-24/26 consume it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/app/shared/infrastructure/me.adapter.ts

@@ -3,7 +3,12 @@ import { Result, ok, err } from '@shared/kernel/fp';
 import { Capability } from '@shared/domain/capability';
 import { ApiClient } from '@shared/infrastructure/api-client';
 
-const KNOWN: readonly Capability[] = ['brief:approve', 'brief:reject', 'brief:send'];
+const KNOWN: readonly Capability[] = [
+  'brief:approve',
+  'brief:reject',
+  'brief:send',
+  'orgtemplate:edit',
+];
 
 /**
  * Infrastructure adapter for `GET /me` (PRD-0002 §6): the current principal's