Enforce scoped role grants (Central-side)

Team member resource grants now actually scoped per server/site, enforced through IAM.