fix: update storage plugins to use scope instead of membershipType

[pyramation]

Summary

Updates the graphile storage plugins (graphile-presigned-url-plugin and graphile-bucket-provisioner-plugin) to use the new scope column on storage_module instead of the removed membership_type column.

Changes:

• StorageModuleConfig.membershipType: string | null → scope: string — no more null, just the scope string ('app', 'org', etc.)
• All SQL queries: sm.membership_type → sm.scope, WHERE membership_type IS NULL → WHERE scope = 'app'
• All entity-scoped checks: membershipType !== null → scope !== 'app'
• Cache keys: storage:{db}:mt:{type} → storage:{db}:scope:{scope}
• Bucket provisioner: same pattern — membership_type → scope in all queries

Companion PR: https://github.com/constructive-io/constructive-db/pull/1415

Review & Testing Checklist for Human

• Verify scope !== 'app' correctly identifies entity-scoped storage (replaces membershipType !== null)
• Verify bucket queries include owner_id column only for entity-scoped storage

Notes

This is a breaking change — requires the constructive-db scope+prefix migration to be deployed first (the storage_module table must have the scope column instead of membership_type).

Link to Devin session: https://app.devin.ai/sessions/f60e6c4d6c1941b497fae2b064722ff3
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[blacksmith-sh]

Found 7 test failures on Blacksmith runners:

Failures

Test	View Logs
Integration tests (uploads, tenant isolation, RLS) › Presigned URL uploads (Alice)/ Deduplication › should return deduplicated=true for an existing content hash	View Logs
Integration tests (uploads, tenant isolation, RLS) › Presigned URL uploads (Alice)/ Private file upload › should accept a PUT to the presigned URL	View Logs
Integration tests (uploads, tenant isolation, RLS) › Presigned URL uploads (Alice)/ Private file upload › should return a presigned PUT URL via uploadAppFile	View Logs
Integration tests (uploads, tenant isolation, RLS) › Presigned URL uploads (Alice)/ Public file upload › should accept a PUT to the presigned URL	View Logs
Integration tests (uploads, tenant isolation, RLS) › Presigned URL uploads (Alice)/ Public file upload › should return a presigned PUT URL via uploadAppFile	View Logs
Integration tests (uploads, tenant isolation, RLS) › Three-way tenant isolation (Alice, Bob, Mallory)/Bob sees his own files	View Logs
Integration tests (uploads, tenant isolation, RLS) › Three-way tenant isolation (Alice, Bob, Mallory)/Bob uploads a file via his primary API	View Logs