Introduce namespaces for memberships.

[Gerrit91]

Description

Closes #130.

[Gerrit91]

I need to provide more tests for this.

[Gerrit91]

So, I tested this out in multiple places now.

First, there are some fresh unit tests for this functionality.

Second, I built the existing repositories that use memberships (metal-apiserver and metalstack.cloud api-server) with this pull request and ensured that all tests are passing.

Third, I started this PR in the mini-lab and run it along with the metal-apiserver + the metalstack.cloud api-server. I ensured project invitations are now namespaced and that both servers do not see each other's memberships. The projects and tenants can be seen in both APIs of course by design.

Here are some extracts:

# from the masterdata-db you can see the metal-apiserver project members are now namespaced:
 4089aad1-cd60-417e-8622-7e284405b44b | {"meta": {"id": "4089aad1-cd60-417e-8622-7e284405b44b", "kind": "TenantMember", "apiversion": "v1", "annotations": {"metal-stack.io/tenant-role": "TENANT_ROLE_OWNER"}, "created_time": {"nanos": 475180591, "seconds": 1757938497}}, "member_id": "CiQwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDISBWxvY2Fs@oidc", "namespace": "metal-stack.io", "tenant_id": "CiQwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDISBWxvY2Fs@oidc"}
 83434f48-d736-412c-b4ee-fe173b72da6f | {"meta": {"id": "83434f48-d736-412c-b4ee-fe173b72da6f", "kind": "TenantMember", "apiversion": "v1", "annotations": {"metal-stack.io/tenant-role": "TENANT_ROLE_OWNER"}, "created_time": {"nanos": 762803446, "seconds": 1757938649}}, "member_id": "CiQwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDESBWxvY2Fs@oidc", "namespace": "metal-stack.io", "tenant_id": "CiQwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDESBWxvY2Fs@oidc"}

❯ mv2 project ls
ID                                    TENANT                                                             NAME    DESCRIPTION  CREATION DATE            
c2959d8f-3eef-4f6f-99fb-93a15793121e  CiQwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDISBWxvY2Fs@oidc  gerrit  test         2025-09-15 12:15:17 UTC  
❯ mv2 project member ls --project c2959d8f-3eef-4f6f-99fb-93a15793121e
ID                                                                 ROLE                 INHERITED  SINCE           
CiQwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDISBWxvY2Fs@oidc  PROJECT_ROLE_OWNER   false      12 minutes ago  
CiQwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDESBWxvY2Fs@oidc  PROJECT_ROLE_VIEWER  false      9 minutes ago  
# and with the metalstack.cloud CLI:
❯ metal project ls
ID                                    TENANT                                                             NAME             DESCRIPTION                                        CREATION DATE            
c2959d8f-3eef-4f6f-99fb-93a15793121e  CiQwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDISBWxvY2Fs@oidc  gerrit           test                                               2025-09-15 12:15:17 UTC  
d295661b-a29e-46ff-88e3-d11159581176  Gerrit91@github                                                    Default Project  Default project of Gerrit91@github                 2025-09-15 10:25:32 UTC  
5b25fc45-e250-48cd-bfc2-969da311c78e  [email protected]@google                                     Default Project  Default project of [email protected]@google  2025-09-15 10:38:40 UTC
❯ metal project member ls --project c2959d8f-3eef-4f6f-99fb-93a15793121e 
ID               ROLE                 INHERITED  SINCE           
Gerrit91@github  PROJECT_ROLE_VIEWER  false      17 seconds ago