fix: reconcile CodeRabbit findings for promotion PR 40

[BeforeLights]

Summary

• reconcile all six actionable findings from promotion PR promote: IAM foundation reconciliation to main #40
• preserve FND-007 handoff, project scope, invitation and membership invariants
• harden hierarchy adapters, HTTP status mapping, DTO validation, and Windows test documentation
• record the single CodeRabbit disposition for PR promote: IAM foundation reconciliation to main #40

Verification

• corepack pnpm repo:check
• corepack pnpm repo:build
• corepack pnpm --filter @databreeze/api test (342 passing)
• corepack pnpm --filter @databreeze/api openapi:check
• git diff --check

This is a focused promotion-gate fix PR. CodeRabbit is intentionally not invoked on feature/fix PRs; PR #40 already consumed its one permitted review.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: fabb0b85-627a-4556-bf9b-cb7718dd3387

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}