feat(marketplace): per-person marketplace access control backend

[LWS49]

Summary

Gates assessment-marketplace browsing per person instead of per current-course role. A typed allow-list - specific user, whole instance, email domain, or everyone - grants access to baseline-capable users, meaning anyone who manages or owns a course anywhere or is an instance instructor/administrator. Per-user access blocks override the allow-list. This PR adds the models and migrations, the matching and audit queries, the ability component that gates :access_marketplace, and the System::Admin endpoints the following PRs consume. No UI yet.

Design decisions

• One rules table with a rule_type discriminator rather than a table per rule kind - the types share every field that matters and differ only in which target column is set, so separate tables would duplicate the CRUD, serialization and matching code for no gain.
• Access blocks are a separate override table rather than rule deletion - a block has to outlive the rule that currently matches the person, otherwise re-adding a domain rule silently restores access to someone an admin deliberately removed.
• Baseline eligibility is computed, not stored - it follows course and instance roles that change constantly, so a cached flag would go stale the moment someone is made a course manager.
• Per-type uniqueness is enforced by partial indexes, not by validation alone - two admins adding the same domain rule concurrently would otherwise both succeed.

Regression prevention

Covers: rule creation per type and rejection of duplicates, resolution of an email to its owning user, everyone-mode reporting, rule deletion, preview counts including blocked matches and their ordering, access-list annotation and serialization, block create and destroy, ability gating for eligible, ineligible and blocked users, and the user baseline predicates.