#998 Expose organization-owned player fan contacts

Let organization members read one fan contact with its separate artist relationships, instead of reconciling duplicate artist profile rows themselves. Existing artist-scoped fan IDs and playback history remain intact.

• Add authenticated, membership-scoped GET /api/players/fans and get_workspace_player_fans MCP tool with bounded pagination and private caching.
• Artist fan lists read the canonical contact profile and expose contact_id; tokens and provider identity are excluded from contact responses. A Spotify connection does not grant marketing consent.
• Validation: 79 focused API tests, 195 active OAuth compatibility tests, formatting and full API lint pass. The tool authorization inventory and runtime catalog include the new tool. Full TypeScript check produces exactly the same existing diagnostics as unchanged main, with no added errors.
• Dependency: apply database #98 before deploying this API change. Production is unchanged. Documentation: docs #356.