Model global-admin exceptions explicitly across UI and API

Observed 2026-09-04 in theft PR #796 / COR-3971 after product clarification: a feature may intentionally authorize either an organization-local admin or a global super admin acting within a selected organization. Model that exception explicitly in both the client visibility predicate and the API authorization call; do not infer it only from a projected membership role/source. Also test global super admins with both synthetic and persisted non-admin memberships, because the latter can otherwise be blocked by a generic admin-only navigation filter even when the feature-specific predicate allows them. Source provenance: product clarification, repository authorization implementation, and regression tests.