[kipavy]

Server side of VoltiusApp/voltius#779.

A pending invitation stored one builtin role name. An invite with several roles kept only the first one, and an invite with a custom role failed.

Change

• Migration 066 adds pending_invitations.role_ids UUID[] NOT NULL DEFAULT '{}'.
• POST /v1/teams/:id/members and POST /v1/teams/:id/invite accept an optional role_ids. Each id goes through the same check as Assign role (require_may_assign_role, now shared with assign_member_role):
  • the role must belong to the team (400 otherwise);
  • custom roles need Business (402);
  • the inviter must cover the role (403).
    A request can carry at most 32 ids.
• admit_member assigns every invited id that still exists. It falls back to the builtin role name only when none of them does, so a role deleted before acceptance is skipped.
• Resending an invite replaces its role_ids, the same way it already replaced role.
• role now holds the most senior invited role, which invitees see in the invite preview and in their pending list. The team's pending list also returns role_ids.
• Audit metadata carries role_ids.

Compatibility

• Clients that send only role get exactly what they get today.
• New clients talking to an older server still send role (a builtin), so the invitee gets that one role.

Tests (new invite_role_tests module)

• Every chosen role survives acceptance, for both the by-id and the email endpoints.
• A role from another team gets 400. A role above the inviter's gets 403. A custom role on a Teams-tier team gets 402, while a builtin role on the same team is accepted.
• A resend replaces the roles. A deleted role is skipped. The display name and the list role_ids are correct.
• Full suite: 815 passed (rust:alpine with a throwaway Postgres).

Needs a deploy before the client change does anything; the client PR follows.