enhance: inherit team access for all units (#38938)

Admin and write team authorize now grant that mode on every unit,
including units added later, instead of only rows present in
`team_unit`. Granular teams keep `authorize=none` and explicit unit
rows.

Closes the `TEAM-UNIT-PERMISSION` design gap from
https://github.com/go-gitea/gitea/pull/34128.

Maybe also fix #15962 (actually maybe it had been fixed before, the root
cause is out-of-sync "access" table)


## Screenshots

only writing selected:
<img width="1399" height="1007" alt="image"
src="https://github.com/user-attachments/assets/1d1b4c49-a59a-47b6-998f-0464a067395b"
/>


_Created with the help of AI_

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

tests/integration/api_packages_test.go

@@ -293,7 +293,8 @@ func TestPackageAccess(t *testing.T) {
 	limitedOrgNoMember := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 22})
 	publicOrgNoMember := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 17})
 
-	uploadPackage := func(doer, owner *user_model.User, filename string, expectedStatus int) {
+	uploadPackage := func(t *testing.T, doer, owner *user_model.User, filename string, expectedStatus int) {
+		t.Helper()
 		url := fmt.Sprintf("/api/packages/%s/generic/test-package/1.0/%s.bin", owner.Name, filename)
 		req := NewRequestWithBody(t, "PUT", url, bytes.NewReader([]byte{1}))
 		if doer != nil {
@@ -395,8 +396,10 @@ func TestPackageAccess(t *testing.T) {
 		}
 
 		for _, c := range cases {
-			for _, t := range c.Targets {
-				uploadPackage(c.Doer, t.Owner, c.Filename, t.ExpectedStatus)
+			for _, target := range c.Targets {
+				t.Run(fmt.Sprintf("%s-%s", c.Filename, target.Owner.Name), func(t *testing.T) {
+					uploadPackage(t, c.Doer, target.Owner, c.Filename, target.ExpectedStatus)
+				})
 			}
 		}
 	})