feat: bypass managed template trial limits for Vercel team members

Summary

Grants Vercel team members unlimited access on the managed deployment (open-agents.dev) by detecting team membership at login and bypassing trial limits. Team membership is checked once during OAuth via the Vercel API and persisted in the session token — no per-request overhead.

Changes

Session (apps/web/lib/session/types.ts, apps/web/lib/session/server.ts)

• Add isAllowedTeamMember boolean to the Session interface
• Pass through the new field when decrypting the session from the cookie

Auth Callback (apps/web/app/api/auth/vercel/callback/route.ts)

• Check Vercel team membership in parallel with user info fetch during OAuth callback
• Store isAllowedTeamMember in the encrypted session token

Trial Logic (apps/web/lib/managed-template-trial.ts)

• Export ALLOWED_VERCEL_TEAM_SLUG constant
• Exclude allowed team members from isManagedTemplateTrialUser — bypasses session, message, and deletion limits

Vercel API (apps/web/lib/vercel/projects.ts)

• Add hasAccessToVercelTeamSlug helper that checks team list for a matching slug (fails closed on error)

Tests (apps/web/app/api/auth/vercel/callback/route.test.ts, apps/web/app/api/sessions/route.test.ts)

• Verify isAllowedTeamMember is set correctly for team and non-team users
• Verify team members can create sessions beyond the trial limit on the managed deployment