Agency Team: invites, roles, and client scope

Go to `/dashboard/agency/team`.

Only Agency Admin can open this page. Agency Staff are blocked in the sidebar, route guard, and API (403).

You will see active staff, pending invites, and how many clients are available to assign.

1. Click invite / add staff.
2. Enter their email.
3. Choose role:

• Agency Admin — full partner controls including Team, Branding, Billing
• Agency Staff — operate on assigned clients only

1. Set client scope:

• Leave empty → access to all clients managed by the agency
• Select specific clients → access limited to those orgs

1. Send the invite. They receive invite mail (agency-branded From when your sender domain is verified).

Invite tokens use the agency invite flow. Acceptance is idempotent: already accepted + existing membership goes to `/dashboard/agency`.

On an existing member:

1. Update role or client scope and save.
2. Narrowing scope immediately removes access to excluded clients (enforced in access checks, not only in the UI).
3. Expanding scope restores those clients for that staff member.

Use empty scope for operators who cover the whole book; use explicit lists for specialists who only support certain brands.

Deactivate sets the member inactive and revokes access while keeping the roster row for audit. Prefer deactivate over destructive deletes.

Last-admin rule: you cannot remove or demote the last active Agency Admin. The UI marks that member as protected. Promote or invite another admin before stepping down.

Agency Staff cannot manage the team page at all — escalate role changes to an Agency Admin.