Extract organiser grant/revoke diffing from Admin::WorkshopsController #2941

Parent: #2938

Problem

Admin::WorkshopsController mutates Member roles directly from private controller methods, on both create (assign_organisers_or_default) and update (update_workshop_details):

def grant_organiser_access(organiser_ids = [])
  organiser_ids.each { |id| Member.find(id).add_role(:organiser, @workshop) }
end

def revoke_organiser_access(organiser_ids)
  (@workshop.organisers.pluck(:id).map(&:to_s) - organiser_ids).each do |id|
    Member.find(id).revoke(:organiser, @workshop)
  end
end

Diffing desired vs current organisers and mutating roles is application-layer orchestration, not HTTP coordination.

Proposed change

• Extract the diff + grant/revoke into a service object under app/services/ (follow the existing *_service conventions there; naming up to the implementer).
• The controller calls it from create/update; the default-to-chapter-organisers branch moves with it.

Acceptance

• Admin::WorkshopsController no longer contains role-diffing logic.
• Organiser membership changes identically after create/update, including the default-to-chapter-organisers path.
• Existing admin workshop controller specs pass.