fix(access-api): invalidate access decisions on membership events

[CleanDev-Fix]

Summary

Fix stale access-decision results after on-chain membership state changes.

Changes

• Bump the existing membership version counter inside the successful
  applyContractEvent() transaction for MembershipMinted,
  MembershipRenewed, and MembershipSuspended/unsuspended events.
• Keep duplicate-event early returns before the bump so replay remains
  idempotent.
• Add an integration regression that warms an ALLOW, applies suspension, and
  verifies the next access check returns DENY with suspended state.

Testing / Verification

• git diff --check passes.
• Workspace packages build successfully; the access-api build/typecheck still
  reports existing baseline errors in prisma/seed.ts, src/index.ts,
  memberService.test.ts, and outboxWorker.ts, with no diagnostic in the
  changed files.
• The integration suite is blocked in this environment because
  DATABASE_URL/PostgreSQL is unavailable.
• The indexer worker suite has 7 passing tests and 2 existing baseline failures.

Closes #120