Provision City Group Chat

Idempotently provisions the caller into their city's private channel:

1. A Mattermost channel for the user's city (if missing)
2. A Mattermost user for the caller (if missing, shared with /group-chat)
3. Membership in the global team and the city channel
4. A fresh PAT for the user

The city allow-list is enforced here rather than only in the client, so an outdated or tampered build can't provision itself into a city we haven't launched.