feat(permission-groups): declare a capability on the organization billing summary read

The merge brought one new operation; the required field refused it until
answered. It is an organization-admin surface — admins and owners sit above
every group — so it is exempt with its reason on record, and its factory now
carries the same definition-time guard the other operation factories do.

Author: waleedlatif1

apps/sim/lib/billing/application/organization-billing-summary/operations.ts

@@ -1,5 +1,6 @@
 import type { Principal } from '@sim/auth/principal'
 import type { ApplicationOperation } from '@/lib/core/application'
+import { assertOperationCapability } from '@/lib/core/application'
 
 export type OrganizationBillingSummaryPrincipal = Extract<Principal, { kind: 'session' }>
 
@@ -13,16 +14,19 @@ export interface OrganizationBillingSummaryOperation<Id extends string = string>
 function defineOrganizationBillingSummaryOperation<const Id extends string>(
   operation: OrganizationBillingSummaryOperation<Id>
 ): OrganizationBillingSummaryOperation<Id> {
+  assertOperationCapability(operation)
   Object.freeze(operation.organizationRoles)
   Object.freeze(operation.principalKinds)
   return Object.freeze(operation)
 }
 
 export const organizationBillingSummaryOperations = {
+  // permission-group-exempt: an organization-admin surface — admins and owners sit above every group, and no group key names organization billing
   read: defineOrganizationBillingSummaryOperation({
     id: 'organization_billing.summary.read',
     organizationRoles: ['admin', 'owner'],
     workspaceApiKey: 'deny',
     principalKinds: ['session'],
+    capability: 'none',
   }),
 } as const