Groups and Org Access UI polish

Things I noticed while checking the Groups list, the group pane and the org Access tab at 1440px (Task 8228): 1. Org Access tab: when a group is expanded, each member shows up twice, once as their own "Via <group>" row and again nested under the group. Collapse the nested list when the members already have their own rows, or mark which is which. 2. Groups list (operator, All orgs): five "Everyone" rows can only be told apart by their org chip. Sort or group the rows by org, or add the org to the title, so it's clear which is which. 3. Group pane Members tab: the "Who" picker and its greyed-out Add button sit on a row above Search. Put the add control under a single "Add member" button, as Grant access does on the Access tab, so the list starts nearer the top. 4. Access tab: an "Inherited from <scope>" row has the same empty action cell that "Via <group>" rows had. Give it the same hint, e.g. "Remove at <scope>". Out of scope: role resolution in the API; access semantics. Done means: - Each item is fixed or declined with a reason in the PR body, with a 1440px screenshot of each affected surface.

Fixed all 4 Groups/Org Access items; PR #6404 merged by lane (2177394). Quick gate + changed-area vitest green; 1440px visual check done, all surfaces good. Jaah Deploy run cancelled (superseded). Follow-ups: draft Task 8318. Memory: none applied.