Limit team members to specific property groups

Problem / context

Team roles control what each teammate can do. But anyone who isn't an Owner still sees every property on the account. Operators with regional managers, owner-relations staff or outside partners can't give those people a view of only the properties they look after. Right now the choice is to show them everything or give them no access at all.

Requested capability

Let an Owner limit any team member to one or more property groups. That person then sees only the properties in those groups, everywhere in Sparrow Intel.

Detail / spec

A Property Access setting for each team member under Account → Team Members, with two choices: All properties or Specific property groups.
It works with every role: Team Member, Read-Only and Custom. Owners always see everything.
A limited user sees the properties in their groups, including any Google and Facebook locations added to those groups. They also see records that aren't tied to any property.
Every list, filter, count, dashboard, report and export covers only that user's properties, so "All" means all of theirs.
Account-wide settings (rules, templates, review settings, integrations, brand and property groups) are view-only for limited users.
If a limited user opens a record outside their access, it shows as not found.
When a group's membership changes, including Auto Groups, the user's access updates automatically.

Acceptance criteria

An Owner can limit a team member to one or more property groups.
That team member sees reviews, dashboards and reports only for the properties in those groups.
A team member limited to no groups sees no properties, never all of them.
When a property is removed from a group, it disappears from that team member's view.

This follows on from Custom Team Member Permissions, which added the Read-Only and Custom roles.