Nested condition trees, derived workspace membership, and host-declared manager roles

Membership rules now support flexible nested condition trees instead of flat AND/OR, enabling complex workspace access policies.