feat(auth): Add mocked service account APIs

[gricha]

Mocked service account APIs behind organizations:service-accounts. They return canned, fully typed responses and persist nothing, so Seer can build against the contract while the real implementation lands behind it.

• Management (control silo): GET/POST /organizations/{org}/service-accounts/ and GET/PUT/DELETE .../{id}/. Reads need org:read, writes need org:admin, and you can only grant scopes you hold.
• Viewer context (cell silo, Seer only): POST .../{id}/viewer-context/. This is the service account counterpart of agent token minting. Seer sends its org-only ViewerContext and gets back {viewerContext, expiresAt, scopes}. It lives in the cell because Seer only reaches its region's Sentry. Until the service account actor exists, it returns Seer's own ViewerContext.

owner is a placeholder until the owning team has a tag.

Design: Service accounts, build order.

Depends on #127716 (control silo URL patterns, frontend), which lands first.

[linear-code]

AIML-3687

[github-actions]

Backend Test Failures

Failures on 83f1434 in this run:

tests/sentry/management/commands/test_generate_controlsilo_urls.py::TestGenerateControlsiloUrls::test_no_missing_urls — log

[gw0] linux -- Python 3.13.15 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/management/commands/test_generate_controlsilo_urls.py:74: in test_no_missing_urls
    assert line in current_state, msg
E   AssertionError: 
E                 New control silo URL patterns detected!
E     
E                 The pattern:   new RegExp('^api/0/organizations/[^/]+/service-accounts/$'),
E     
E                 Does not exist in the current pattern inventory. You should regenerate
E                 the pattern inventory with:
E     
E                 cd ../getsentry
E                 getsentry django generate_controlsilo_urls --format=js --output=../sentry/static/app/data/controlsiloUrlPatterns.ts
E     
E                 This command needs to be run in a getsentry environment
E                 in order to not lose patterns that are important for sentry.io
E                 
E   assert "  new RegExp('^api/0/organizations/[^/]+/service-accounts/$')," in "// This is generated code.\n// To update it run `getsentry django generate_controlsilo_urls --format=js --output=/pat...gExp('^extensions/discord/link-identity/[^/]+/$'),\n  new RegExp('^extensions/discord/unlink-identity/[^/]+/$'),\n];\n"