enhance: inherit team access for all units (#38938)

Admin and write team authorize now grant that mode on every unit,
including units added later, instead of only rows present in
`team_unit`. Granular teams keep `authorize=none` and explicit unit
rows.

Closes the `TEAM-UNIT-PERMISSION` design gap from
https://github.com/go-gitea/gitea/pull/34128.

Maybe also fix #15962 (actually maybe it had been fixed before, the root
cause is out-of-sync "access" table)


## Screenshots

only writing selected:
<img width="1399" height="1007" alt="image"
src="https://github.com/user-attachments/assets/1d1b4c49-a59a-47b6-998f-0464a067395b"
/>


_Created with the help of AI_

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

tests/integration/org_project_test.go

@@ -6,6 +6,7 @@ package integration
 import (
 	"net/http"
 	"slices"
+	"strconv"
 	"testing"
 
 	unit_model "gitea.dev/models/unit"
@@ -50,7 +51,7 @@ func TestOrgProjectAccess(t *testing.T) {
 		"team_name":   "team1",
 		"repo_access": "specific",
 		"permission":  "read",
-		"unit_8":      "0",
+		"unit_" + strconv.Itoa(unit_model.TypeProjects.Value()): "0",
 	})
 	session.MakeRequest(t, req, http.StatusSeeOther)