feat(members): offer the analyst role on invite and role change - #2549

🟢 Confidence 10/10 · safe to merge. Analyst joins the one list every picker reads, and the invite default stays org:member; the earlier memberEntry position note is untouched.
_{1 note · tests covered · risk medium}

Adds the analyst role to Policy.assignableRoles, so the Members page's invite, row and confirm-strip pickers offer it, and unknown role keys now read as analyst. roleOf is unchanged in behavior because the merged list is the same lookup. Safe to merge once the role exists in Clerk.

• assignableRoles gains an org:analyst entry first, replacing the private clerkRoles list
• Unknown Clerk role keys now display as Analyst instead of Member
• memberEntry moves to assignableRoles[1] since member is no longer first

Before merge

• Manual · Create org:analyst (name "Analyst", no system permissions, in the default role set) on the production auth instance before this deploys
• Manual · Confirm production Clerk has no role keys other than admin, member and engineer: any other key now shows as Analyst

Still open from earlier reviews

• 🔵 Note · F1 · memberEntry is looked up by array position, not by role · apps/web/src/page/settings/kit/org-membership.ts:11

_{6a35f17 · Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}