Create a subcontractor

Creates a subcontractor and its FGA group with project:upload access. Each contact-person email is resolved against the customer's WorkOS org: existing org users are added directly without a WorkOS invitation; new emails receive an invitation.

IMPORTANT — partial success: responds 201 when everything succeeded, or 207 with the created subcontractor plus a warnings array when it was created but one or more contact persons could not be given access. 207 does NOT mean 'maybe created' — the company exists and is returned in both cases. This mirrors the DELETE route. The rollback boundary is the first sent WorkOS invitation: before it, a failure rolls back completely and returns an error; after it, the create commits, because WorkOS exposes no way to revoke an invitation and a rollback would leave the invitee holding a link to a company that no longer exists.

Company names are unique per project (trimmed, case-insensitive). A duplicate is refused with 409 DuplicateCompanyNameError before anything is written, so the request is a no-op — clients should surface it as validation on the name field, not as a failed create. Names of removed subcontractors become available again.