enhance: inherit team access for all units (#38938)

Admin and write team authorize now grant that mode on every unit,
including units added later, instead of only rows present in
`team_unit`. Granular teams keep `authorize=none` and explicit unit
rows.

Closes the `TEAM-UNIT-PERMISSION` design gap from
https://github.com/go-gitea/gitea/pull/34128.

Maybe also fix #15962 (actually maybe it had been fixed before, the root
cause is out-of-sync "access" table)


## Screenshots

only writing selected:
<img width="1399" height="1007" alt="image"
src="https://github.com/user-attachments/assets/1d1b4c49-a59a-47b6-998f-0464a067395b"
/>


_Created with the help of AI_

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

models/unittest/unit_tests.go

@@ -27,6 +27,7 @@ type TestingT interface {
 	require.TestingT
 	assert.TestingT
 	Context() context.Context
+	Helper()
 }
 
 type testCond struct {
@@ -77,6 +78,7 @@ func GetBean[T any](t TestingT, bean T, conditions ...any) (ret T) {
 
 // AssertExistsAndLoadBean assert that a bean exists and load it from the test database
 func AssertExistsAndLoadBean[T any](t TestingT, bean T, conditions ...any) T {
+	t.Helper()
 	exists, err := getBeanIfExists(t, bean, conditions...)
 	require.NoError(t, err)
 	require.True(t, exists,
@@ -87,6 +89,7 @@ func AssertExistsAndLoadBean[T any](t TestingT, bean T, conditions ...any) T {
 
 // AssertExistsAndLoadMap assert that a row exists and load it from the test database
 func AssertExistsAndLoadMap(t TestingT, table string, conditions ...any) map[string]string {
+	t.Helper()
 	e := db.GetEngine(t.Context()).Table(table)
 	res, err := whereOrderConditions(e, conditions).Query()
 	assert.NoError(t, err)
@@ -123,6 +126,7 @@ func GetCount(t TestingT, bean any, conditions ...any) int {
 
 // AssertNotExistsBean assert that a bean does not exist in the test database
 func AssertNotExistsBean(t TestingT, bean any, conditions ...any) {
+	t.Helper()
 	exists, err := getBeanIfExists(t, bean, conditions...)
 	assert.NoError(t, err)
 	assert.False(t, exists)
@@ -130,17 +134,20 @@ func AssertNotExistsBean(t TestingT, bean any, conditions ...any) {
 
 // AssertCount assert the count of a bean
 func AssertCount(t TestingT, bean, expected any) bool {
+	t.Helper()
 	return assert.EqualValues(t, expected, GetCount(t, bean))
 }
 
 // AssertInt64InRange assert value is in range [low, high]
-func AssertInt64InRange(t assert.TestingT, low, high, value int64) {
+func AssertInt64InRange(t TestingT, low, high, value int64) {
+	t.Helper()
 	assert.True(t, value >= low && value <= high,
 		"Expected value in range [%d, %d], found %d", low, high, value)
 }
 
 // GetCountByCond get the count of database entries matching bean
 func GetCountByCond(t TestingT, tableName string, cond builder.Cond) int64 {
+	t.Helper()
 	e := db.GetEngine(t.Context())
 	count, err := e.Table(tableName).Where(cond).Count()
 	assert.NoError(t, err)