refactor(user-management): move byte-identical team_service to autobot_shared (#12647)

[mrveiss]

Closes #12647

Partial slice — the issue must stay open after merge. The close keyword
above is required by the Validate PR issue link gate; merging to
Dev_new_gui does not auto-close, and #12647 still has rbac_middleware.py,
user_service.py and organization_service.py outstanding. Same handling as
the earlier slices #13126 / #13130 / #13163.

Thinking Path

services/team_service.py was byte-identical across autobot-backend and
autobot-slm-backend:

$ diff autobot-backend/user_management/services/team_service.py \
       autobot-slm-backend/user_management/services/team_service.py
$ echo $?
0

701 lines duplicated verbatim, which is the exact failure mode #12645 exists to
end: a fix lands in one service and silently never reaches the other.

It is the first user_management service that can actually move, and that
is worth being precise about, because its byte-identical twin cannot. The whole
question is what a service needs at runtime:

dependency	where it lives	since
Team, TeamMembership	autobot_shared	#13130
AuditAction, AuditLog, AuditResourceType	autobot_shared	#13130
BaseService, TenantContext	autobot_shared	#12972

Every runtime dependency is already shared. User and Organization appear in
this file only in docstrings and error strings, never as classes — verified
by grep — so it does not need the concrete per-backend models.

organization_service.py is also byte-identical (545 lines) and is
deliberately not in this PR: it does from user_management.models import Organization, Team, User at runtime, and those concrete classes stay
backend-local by design (#13163). Moving it would force autobot_shared to
import a backend-local package — an inverted dependency. It needs its own
resolution, not a copy of this one.

What Changed

• New autobot_shared/user_management/team_service.py — the implementation,
  with its three imports repointed at the shared modules.
• Both backends keep a re-export shim exporting the full public surface
  (TeamService, TeamServiceError, TeamNotFoundError, DuplicateTeamError,
  MembershipError), so every importer — including each
  user_management/services/__init__.py — is untouched.
• New autobot_shared/user_management/team_service_test.py (8 tests).

Placement: flat, as autobot_shared/user_management/team_service.py,
matching the existing base_service.py rather than inventing a second
services/ location for the same category of file. The package's lazy
_LAZY_IMPORTS already spells base_service as .base_service.

Verification

Identity, not just equivalence. The tests assert both shims resolve to the
same objects — two same-named classes are not interchangeable, the trap
#12913 fixed for CircuitState.

$ PYTHONPATH=$PWD python3 -m pytest autobot_shared/user_management -q
40 passed

(8 of these are the new team_service_test.py; see the note on the 5 failures
below.)

Both backends import through the shim and configure cleanly:

$ PYTHONPATH=$PWD/autobot-backend:$PWD python3 -c "..."
BACKEND: services import + configure_mappers OK, identity OK
TeamService.VALID_ROLES: ['admin', 'member', 'owner']

$ PYTHONPATH=$PWD/autobot-slm-backend:$PWD python3 -c "..."
SLM: services import + configure_mappers OK, identity OK

Consumer suites:

autobot-slm-backend/user_management     26 passed
autobot-backend/user_management         34 passed, 3 failed (pre-existing)

The 3 backend failures are rbac_denial_audit_test.py::TestAuditVocabulary,
red on Dev_new_gui itself since #13130 relocated models/audit.py. They are
unrelated to this change and are fixed in PR #13163. For the same reason,
models/base_test.py's 5 failures in the shared run are pre-existing (_ROOT
off-by-one from #13126) and also fixed in #13163. Merge order between the two
PRs does not matter; neither touches the other's files.

isort, black --line-length=120 and flake8 --config=.flake8 clean on all
four touched files.

Note

Importing the SLM package during verification auto-generated a .slm_keys
file into the worktree (it is gitignored, so it was never committable). It was
removed, and the remaining runs used throwaway SLM_SECRET_KEY /
SLM_ENCRYPTION_KEY values per #13090's guidance. Both worktrees confirmed
clean of key material.

Model Used

Claude Opus 5 (1M context)

[github-actions]

✅ SSOT Configuration Compliance: Passing

🎉 No hardcoded values detected that have SSOT config equivalents!