Backfill org-team permission data from MLEDB into Sprocket

[gankoji]

Summary

Backfill existing org-team / LO / admin permission data from legacy MLEDB tables into the new Sprocket authorization model.

Why

Once Sprocket owns permission writes, existing legacy users still need to be migrated so that auth and guarded operations continue working without legacy lookups.

Source data

• mledb.player
• mledb.player_to_org

Scope

• Implement an idempotent backfill for historical org-team assignments.
• Define how to handle missing/mismatched player mappings.
• Produce a parity report for migrated users and permission assignments.

Acceptance criteria

• Existing org-team assignments are present in Sprocket.
• The backfill can be rerun safely.
• Mismatches and unmapped records are surfaced in a validation report.
• After backfill, auth cutover can proceed without loss of existing permissions.