feat(web): hq-sourced members are read-only here

The lock is a courtesy — the API answers 409 either way. NEXT_PUBLIC_HQ_URL
defaults empty so a self-hosted install shows a plain label rather than a
link to a portal that does not serve them.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

web/lib/api.ts

@@ -335,7 +335,10 @@ export interface InstanceUser {
     instance_id: string;
     email: string;
     role: Role;
-    auth_source: "local" | "oidc";
+    // "hq" means the row was projected from a Vantage HQ account. Its role,
+    // password and existence belong to HQ; this instance refuses to change them.
+    auth_source: "local" | "oidc" | "hq";
+    hq_user_id?: string;
     created_at: string;
     last_login?: string;
 }