feat(marketplace): access audit list and per-user block controls

[LWS49]

Summary

Adds the access audit section beneath the allow-list: a list of everyone who currently has marketplace access, why they are eligible, and which rule or rules grant it. The list is filterable by status and by granting rule, each row carries block and re-enable controls, and a separate section surfaces dormant blocks - blocks that no rule currently matches.

Design decisions

• Blocking is exposed per person from the audit list rather than on its own screen - the decision to block is made while reading who has access, not in isolation.
• Dormant blocks are surfaced rather than hidden - such a block denies nothing today, but it takes effect again the moment a rule starts matching that person, so an admin has to be able to see and clear it.
• Rules that currently grant access to nobody are flagged in place rather than auto-removed - an admin may deliberately add a rule ahead of the people it will match.

Regression prevention

Covers: audit list rendering with eligibility and granting-rule annotations, system administrators listed without any matching rule, rows present only because the person is blocked, the status and granting-rule filters plus clear-all, block and re-enable including failure toasts, the dormant blocks section, and the summary and filtered count lines.