Authoritative Firebase-linked business memberships.
Firebase identity is mapped to an active PostgreSQL membership; server authorization and tenant isolation remain authoritative.