Model global-admin exceptions explicitly across UI and API
Observed 2026-09-04 in theft PR #796 / COR-3971 after product clarification: a feature may intentionally authorize either an organization-local admin or a global super admin acting within a selected organization. Model that exception explicitly in both the client visibility predi…