feat(enterprise): add RBAC administration commands

[xe-nvdk]

Context

arcli can manage API tokens and display a token's effective permissions, but it cannot administer the Arc Enterprise RBAC model. Organizations, teams, roles, measurement permissions, and token-to-team assignments still require curl or an SDK.

Scope

Add a coherent arcli rbac command tree covering:

• organizations: list, show, create, update, delete
• teams: list by organization, show, create, update, delete
• roles: list by team, show, create, update, delete
• measurement permissions: list, create, delete
• token team membership: list, add, remove

This maps to /api/v1/rbac/* and /api/v1/auth/tokens/:id/teams*. Existing arcli auth token permissions should remain the effective-permissions view.

Acceptance criteria

• All RBAC CRUD and token-team endpoints above are represented
• Token references accept id or exact name where arcli already supports that convention
• List commands support table, JSON, and CSV; object commands support table and JSON
• Destructive operations prompt and support --yes
• Enterprise-license, admin-permission, conflict, and not-found responses remain distinguishable
• Typed client and command tests cover success, validation, and server errors
• README/help and release notes document the new command tree