MemberGroup: restrict bypass to own_data via MemberGroupReadLinkedForOwnData

- ActorPermissionSetIs check; bypass policy filters by member_id for own_data only.
- Admin with member_id still gets :all via HasPermission. Tests added.

test/mv/membership/member_group_policies_test.exs

@@ -184,6 +184,39 @@ defmodule Mv.Membership.MemberGroupPoliciesTest do
       assert mg.id in ids
     end
 
+    test "admin with member_id set (linked to member) still reads all member_groups", %{
+      actor: actor
+    } do
+      # Admin linked to a member (e.g. viewing as member context) must still get :all scope,
+      # not restricted to linked member's groups (bypass is only for own_data).
+      admin = Mv.Fixtures.user_with_role_fixture("admin")
+      linked_member = create_member_fixture()
+      other_member = create_member_fixture()
+      group_a = create_group_fixture()
+      group_b = create_group_fixture()
+
+      admin =
+        admin
+        |> Ash.Changeset.for_update(:update, %{})
+        |> Ash.Changeset.force_change_attribute(:member_id, linked_member.id)
+        |> Ash.update(actor: actor)
+
+      {:ok, admin} = Ash.load(admin, :role, domain: Mv.Accounts, actor: actor)
+
+      mg_linked = create_member_group_fixture(linked_member.id, group_a.id)
+      mg_other = create_member_group_fixture(other_member.id, group_b.id)
+
+      {:ok, list} =
+        Mv.Membership.MemberGroup
+        |> Ash.read(actor: admin, domain: Mv.Membership)
+
+      ids = Enum.map(list, & &1.id)
+      assert mg_linked.id in ids, "Admin with member_id must see linked member's MemberGroups"
+
+      assert mg_other.id in ids,
+             "Admin with member_id must see all MemberGroups (:all), not only linked"
+    end
+
     test "can create member_group", %{user: user, actor: _actor} do
       member = create_member_fixture()
       group = create_group_fixture()