fix: scope card member assignments to the workspace

[bionicman]

Description

Card member IDs were resolved globally in the create and add/remove paths. A
caller with permission to edit a card could therefore supply a membership ID
from another workspace.

This change derives the workspace from the target card or list and uses it for
all member lookups. Card creation validates the complete member set before
writing the card, so a mixed valid/foreign request fails atomically. Card
duplication applies the same boundary as defense in depth for legacy or
otherwise inconsistent relationships. Soft-deleted memberships are excluded
from these assignment lookups as well.

The behavior is covered for card creation, add/remove and duplication.

Type of change

• Bug fix
• Feature (requires an approved issue — see below)
• Refactor / chore
• Documentation

Checklist

• I have linked the related issue below
• My code follows the existing style and conventions
• I have tested my changes locally
• I have included screenshots for any UI changes (not applicable)

Testing

• pnpm --filter @kan/api test -- card-members.test.ts
• pnpm --filter @kan/db typecheck
• pnpm --filter @kan/api exec tsc --noEmit --jsx preserve

Linked issue

Refs #416. This intentionally addresses only the card-member assignment part
of that report, so it does not close the broader issue.

The same workspace-boundary class was previously addressed for member and
permission endpoints in #410 / #413.

[hjball]

good stuff @bionicman