Roles, part 2: a guest cannot own a repository or start a crew run, and every older refusal keeps its own reason #2302

Part of #673.

Done looks like:

• [ ] Creating a repository, make-it-yours, and starting a run are refused to a guest, with the words "the owner has not made this account a member". This replaces the emergency database guard for those acts.
• [ ] The refusals that already exist are checked first, so their reasons stay the same: unverified, suspended, agent, stranger to a private repository. test/make-it-yours.test.ts passes unchanged.
• [ ] Tests: a guest is refused each act through the page and through the API, and a member is allowed.