feat: [PLAT-5936] Allow-list support for private studios

[sabulous]

Description

Ticket: PLAT-5936

This PR adds CLI support for the private-studio allow list — the users, besides the creator, who may connect to and start a private studio.

Changes

• Set the list on add — Set the allow list when creating a private studio with the repeatable --allow-user <userId> option (available on add, add-as-new, and start). The platform currently caps it at a single additional user.

  tw studios add -n my-studio -w my-workspace -c my-ce -t <template> --private --allow-user <user_id>

• Override the list on start — start --allow-user replaces the existing allow list; omit it to leave the list unchanged. Only the studio creator may change it.
  Note: the override only applies when the studio is startable (stopped) — starting an already-running studio won't change the list.

  tw studios start -w my-workspace -n my-studio --allow-user <user_id>

• Studio view shows the allow list — the studio view now includes an Allowed users row.

• Lookup-by-name returns full detail — view -n (and start/update by name) now fetch the full studio via describe after resolving the name, so name-based lookups match id-based ones (the list response omits allowedUsers).

  tw studios view -w my-workspace -n my-studio

Example cli testing session with various cases

Setup: These are real runs against a local backend, workspace hello1 / 1-wsp. The studio cli-priv-1 is created by user sab. 21 is user nonowner and 8 is user permiss, both workspace members. 21 is added to the allow list at creation; 8 replaces it later via start.

Create a private studio with an allowed user

$ tw studios add -w 152937999146850 -n cli-priv-1 -t cr.seqera.io/public/data-studio-jupyter:4.2.5-snapshot -c nwelocal --private --allow-user 21

  Studio 9def339e CREATED at [hello1 / 1-wsp] workspace.

Passing the creator's own id is accepted (creator is dropped, not counted)

$ tw studios add -w 152937999146850 -n cli-priv-cap -t cr.seqera.io/public/data-studio-jupyter:4.2.5-snapshot -c nwelocal --private --allow-user 21 --allow-user 2

  Studio bfdbc317 CREATED at [hello1 / 1-wsp] workspace.

# user 2 (sab) is the creator, so it's dropped from the allow list;
# the effective list is just [21], which is within the 1-user cap.

Reject: allow-user on a non-private studio

$ tw studios add -w 152937999146850 -n cli-non-priv-cap -t cr.seqera.io/public/data-studio-jupyter:4.2.5-snapshot -c nwelocal --allow-user 21 --allow-user 2

 ERROR: Studio allow list is only supported for private studios.

Reject: more than the allowed number of users

$ tw studios add -w 152937999146850 -n cli-priv-cap-2 -t cr.seqera.io/public/data-studio-jupyter:4.2.5-snapshot -c nwelocal --private --allow-user 21 --allow-user 8

 ERROR: A private studio can be shared with at most 1 additional user(s).

Reject: a user who is not a member of the workspace

$ tw studios add -w 152937999146850 -n cli-priv-bad -t cr.seqera.io/public/data-studio-jupyter:4.2.5-snapshot -c nwelocal --private --allow-user 999999

 ERROR: One or more specified users are not members of this workspace.

Replace the allow list on start (creator only; studio must be stopped)

$ tw studios start -w 152937999146850 -n cli-priv-1 --allow-user 8

  Studio cli-priv-1 START successfully submitted at [hello1 / 1-wsp] workspace.

$ tw studios view -w 152937999146850 -n cli-priv-1

  Studio at workspace '[hello1 / 1-wsp]'
 ---------------------+------------------------------------------------
  SessionID           | 9def339e
  Name                | cli-priv-1
  Status              | STARTING
  Created by          | sab | sab@seqera.io
  Allowed users       | permiss | permiss@seqera.io
  ...

Start without --allow-user leaves the list unchanged

$ tw studios stop -w 152937999146850 -n cli-priv-1
  Studio cli-priv-1 STOP successfully submitted at [hello1 / 1-wsp] workspace.

# after it reaches STOPPED:
$ tw studios start -w 152937999146850 -n cli-priv-1
  Studio cli-priv-1 START successfully submitted at [hello1 / 1-wsp] workspace.

$ tw studios view -w 152937999146850 -n cli-priv-1
  ...
  Allowed users       | permiss | permiss@seqera.io   # unchanged