fix(workforce): team_members.role, not role_slot

The roster query named tm.role_slot. That column is on agent_template_link;
team_members calls it plain `role`. These queries use untyped sqlx::query(),
so nothing caught it at compile time and the endpoint 500'd on its first real
request — the 401 an unauthed probe returns looks identical whether the SQL is
valid or not, which is why the payload had to be fetched with a real session
before believing the route worked.

Co-Authored-By: Claude Opus 5 <[email protected]>

crates/cm-api/src/routes/missions.rs

@@ -1712,14 +1712,14 @@ pub async fn workforce(
                 a.job_title           AS job_title,
                 a.accent              AS accent,
                 a.status              AS agent_status,
-                tm.role_slot          AS role_slot
+                tm.role               AS role_slot
            FROM missions m
            JOIN mission_teams mt ON mt.mission_id = m.id
            JOIN team_members tm  ON tm.team_id    = mt.team_id
            JOIN agents a         ON a.id          = tm.claw_id
           WHERE m.workspace_id = $1
             AND a.deleted_at IS NULL
-          ORDER BY m.created_at DESC, tm.role_slot ASC",
+          ORDER BY m.created_at DESC, tm.role ASC",
     )
     .bind(ws)
     .fetch_all(&state.pool)