fix: keep existing privileges when User.Added is processed late

Setup() registers one transient consumer per routing key, and each mints its
own queue drained by its own goroutine, so User.Added and Privilege.Added for the
same company can be processed in either order. Process(*UserAdded) replaced the
company entry with empty privileges, so a Privilege.Added handled first lost its
privilege until the next Fetch(), which only runs at service start.

Create the entry only when it is missing instead, matching authz-service's own
aggregate and read view, which both leave an existing user entry alone. This also
makes a User.Added redelivery harmless.

Seen as authz-service #826 acceptance-test failures: a new company's Admin grant
vanished, so company-service's CreateCompany callback waited out its 30s timeout
and the company page stayed empty.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XMvdB7bcwn1CrQKM4dCshM

client.go

@@ -123,12 +123,17 @@ func (h *PrivilegeHandler) Process(msg any) error {
 
 	switch ev := msg.(type) {
 	case *UserAdded:
-		if priv, exists := h.privileges[ev.Email]; exists {
+		// Keep the privileges already recorded for the company. Each routing key has
+		// its own transient queue, so a Privilege.Added published after this event can
+		// be processed before it; overwriting the entry here would drop that privilege
+		// until the next Fetch, which only runs at start.
+		priv, exists := h.privileges[ev.Email]
+		if !exists {
+			priv = map[string]*CompanyPrivileges{}
+			h.privileges[ev.Email] = priv
+		}
+		if _, exists := priv[ev.CompanyID]; !exists {
 			priv[ev.CompanyID] = &CompanyPrivileges{}
-		} else {
-			h.privileges[ev.Email] = map[string]*CompanyPrivileges{
-				ev.CompanyID: {},
-			}
 		}
 		return nil
 	case *UserRemoved: