Move the admin surface toward explicit, backend-owned routers instead of
trimming the proxy app by path allowlist. This adds a backend/routers package
whose teams router is the source of truth for /admin/teams CRUD plus membership;
proxy_server imports and mounts it (guarded by the backend package being
importable, since the pip wheel ships only litellm), and backend/main keeps
those explicit routes regardless of the allowlist.
Every route authenticates through the auth_v2 AuthSecurity stored on
app.state.auth_v2 (a require_roles gate over the Principal) rather than the
legacy user_api_key_auth dependency; app.state.auth_v2 is wired in the proxy
startup once the DB is connected.
Two resolver fixes were needed to make the DB-backed path actually work, since
it was previously only exercised against an in-memory store: API-key principals
now resolve their platform role from the owning user (get_key_object does not
join user_role onto the token), and team group writes wrap members_with_roles
in prisma Json so upsert_group persists. db_team_to_scim now carries members so
team membership round-trips on read.
