Create Subaccount

Create a new trading subaccount. Any active org member can create one; account_type is pinned to non_custodial server-side. A non-admin creator gets an explicit admin grant on the new subaccount (org admins hold derived access on every subaccount and never get grant rows).

Runs on the unscoped session: the creator holds no user:manage grant on the subaccount until this transaction writes it, so the scoped-session RLS WITH CHECK on subaccount_grants can never admit the bootstrap row.