feat(website): launch Mastermind Council experience

[bokelley]

Summary

• rebrand public council surfaces with the supplied Mastermind Council copy
• render indexed document summaries as sanitized plain text
• require active paid membership for launched council joins across web and Addie
• preserve Explorer and inherited eligibility, plus the prelaunch interest funnel
• restore the join action after join/leave transitions

Closes #6366

Testing

• npm run typecheck
• npx vitest run server/tests/unit/working-group*.test.ts server/tests/unit/membership-tiers.test.ts server/tests/unit/mastermind-council-membership-service.test.ts server/tests/unit/mastermind-council-surfaces.test.ts server/tests/unit/active-membership-service.test.ts server/tests/unit/markdown-to-plain-text.test.ts (103 tests)
• DOMPurify allowlist test covering resource-bearing HTML attributes
• git diff --check

Review

Product, website UI, code quality, and security experts reviewed this implementation. All findings were addressed before publication.

No changeset: this changes server/public website and Addie surfaces only.

[aao-secretariat]

Ladon verdict: Approve

Approve — platform-only PR (server/**) with no blocking or Medium findings.

This PR renames Industry Councils to Mastermind Councils and adds a fail-closed paid-membership gate on self-serve council joins, plus a markdown-to-plain-text summary sanitizer. No protocol/schema/dist/docs surface is touched, so changeset, schema↔docs coherence, oneOf, and artifact-immutability rules do not apply.

Decision-table walkthrough:

• Row 1 (critical/high): no such findings — falls through.
• Row 2 (gated_paths): gated_paths is false — does not apply.
• Row 3/5 (high_risk + deleted/modified with medium): high_risk is true (member-tools.ts and committees.ts modified), but there are no Medium-or-higher findings, so the modified-file escalation triggers do not fire.
• Row 4 (medium data-loss/schema/infra): no Medium findings.
• Row 6 (sticky escalate): no prior decision.
• Row 7 (no-auto-approve team): no team match.
• Row 8 (≥3 medium): only two Low findings, zero Medium.
• Row 9: approve.

The new authorization boundary is well-shaped: a single self-serve chokepoint (joinWorkingGroup), fail-closed on DB/resolver error, cache-bypassing, per-org checks, and comprehensively unit-tested.

Non-blocking nits (Low): council rename left some admin/dashboard/onboarding surfaces on 'Industry Council'; and a transient DB failure denies a paying member with the $50 upsell copy — worth a follow-up but neither blocks.

[bokelley]

Addressed the CI finding in 0a5607a by completing the org-filters mock used by the Addie admin boundary suite.

On the two Ladon low-severity notes:

• The requested rename is intentionally scoped to the Committees landing and council detail surfaces in Mastermind Council Launch - Content + Workflow Updates #6366. Existing admin, membership-product, curriculum, and onboarding terminology is outside this launch-content change and may encode current tier/product names, so this PR leaves those surfaces unchanged.
• The fail-closed path intentionally uses the same exact paid-tier notice as an ordinary denial. That wording is a supplied acceptance requirement shared by web and Addie; returning resolver internals would disclose operational state and make the authorization response inconsistent.

No unresolved review thread remains on the current head.

[aao-secretariat]

Re-approval: no reviewable delta since the prior approval; re-submitting after stale-review dismissal.