feat(positions): wire staffing clients to consumer APIs

[windischb]

Summary

• allow terminal-managed Staffing clients to select target Apps and resource-bearing business scopes
• derive aud from scope resources and emit Position RBAC in resource_access
• keep terminal security/lifecycle fields locked while making Display Name, Apps, and Scopes editable
• end active Staffing sessions when the terminal access profile changes
• document the AlertHub consumer wiring, including RFC 8707 resource URI rules

Verification

• dotnet test ... --filter FullyQualifiedName~Modgud.Api.Tests.Positions: 89/89 passed
• targeted AlertHub audience/resource_access E2E: passed
• frontend type-check: passed
• frontend production build: passed
• VitePress docs build: passed
• git diff --check: passed