Team join policy: join-any-team-as-contributor vs require approval

Split out of the configurability epic (PAR-189), built on its settings substrate.

A workspace setting controlling how people join teams:

• Open: any workspace member can join a team as a contributor themselves.
• Approval: a team lead/admin must add them (today's invite-only behaviour).

Scope:

• Add a joinPolicy key to workspace_settings (the JSONB substrate from PAR-189) + a toggle in the Features/settings UI.
• A self-serve "join team" path + a request-to-join + approval queue for the approval mode. Today membership is invite-only via addMemberAction (gated on member.manage).
• Note: tesks membership is currently workspace-level; team-level membership doesn't exist yet — this likely needs the team membership model from the teams work (PAR-187 noted no team detail/membership screen). Coordinate with that.