CustomField policies: actor required, no system-actor fallback, error handling

- list_required_custom_fields: require actor (two clauses, no default)
- Member validation: use context.actor only, differentiate Forbidden vs transient errors
- stream_custom_fields: log + send flash on error instead of returning []
- GlobalSettingsLive: handle_info for custom_fields_load_error, put_flash
- Seeds: use Membership.update_member with actor, format

priv/repo/seeds.exs

@@ -381,12 +381,16 @@ Enum.each(member_attrs_list, fn member_attrs ->
   final_member =
     if is_nil(member.membership_fee_type_id) and
          Map.has_key?(member_attrs_without_status, :membership_fee_type_id) do
-      member
-      |> Ash.Changeset.for_update(:update_member, %{
-        membership_fee_type_id: member_attrs_without_status.membership_fee_type_id
-      })
-      |> Ash.Changeset.put_context(:actor, admin_user_with_role)
-      |> Ash.update!(actor: admin_user_with_role)
+      {:ok, updated} =
+        Membership.update_member(
+          member,
+          %{
+            membership_fee_type_id: member_attrs_without_status.membership_fee_type_id
+          },
+          actor: admin_user_with_role
+        )
+
+      updated
     else
       member
     end
@@ -546,9 +550,12 @@ Enum.with_index(linked_members)
       fee_type_index = rem(3 + index, length(all_fee_types))
       fee_type = Enum.at(all_fee_types, fee_type_index)
 
-      member
-      |> Ash.Changeset.for_update(:update_member, %{membership_fee_type_id: fee_type.id})
-      |> Ash.update!(actor: admin_user_with_role)
+      {:ok, updated} =
+        Membership.update_member(member, %{membership_fee_type_id: fee_type.id},
+          actor: admin_user_with_role
+        )
+
+      updated
     else
       member
     end