Make Sprocket authoritative for franchise roster/staff reads (GH-728)

[gankoji]

Summary

Implements a Sprocket-first read path for franchise roster slots, staff/captain roles, and documents the temporary MLE legacy mirror for issue #728.

What changed

• RosterAuthorityService (core/src/franchise/roster-authority.service.ts): After MLE player changes, projects state into sprocket.roster_slot (via mledb_bridge.team_to_franchise + league_to_skill_group + MLE role codes) and into franchise_staff_appointment / franchise_leadership_appointment (from MLE team staff columns, team_to_captain, and PR support when a matching franchise_staff_role named PR Support exists).
• PlayerService: Runs sync after MLE player saves (and after updatePlayer / intakeUser commits so the bridge row exists).
• FranchiseService.getPlayerFranchisesByUserId: Uses Sprocket appointments + roster slots when present; otherwise falls back to the previous MLE-only implementation (cold start / missing seed data).
• reports/issue-728-sprocket-roster-authority.md: States source of truth, legacy mirror, and removal checklist.

Suspension

getLeagueSuspendedFromMle is added for callers that need mledb.player.suspended until a first-class Sprocket field exists (not wired into GraphQL in this PR).

Proof

• npm run build --workspace=core (passes).

Follow-ups (not in this PR)

• One-shot backfill job for existing production rows where MLE was updated outside these code paths.
• Native Sprocket suspension storage and retiring MLE suspended.
• RFA as more than a pseudo team name if product requires it.