Authorize invitation history and resend for the acting team manager

[rafiki270]

Summary

Invitation history, invitation detail and resend now authenticate the acting user and require current members.manage for the exact target team. Previously these routes ignored user credentials and bypassed the shared role gate. Credential-free requests now require the documented backend opt-in and origin-domain isolation.

Adds 36 route regressions covering subject assertions, live membership, custom grants, stale privileges, malformed credentials and backend isolation. The API schema and integration guide document the corrected boundary and existing camelCase membership request fields.

Testing

• Passed 107 focused invitation and roster tests across 10 files.
• Passed API TypeScript checking, ESLint for changed code and git diff --check.
• PostgreSQL integration coverage runs in CI. No real invitations were emailed or user permissions modified.
• Local billing protocol build encountered existing generated-artifact line-ending drift on Windows; its TypeScript build completed.