feat: room subsystem (visibility, multi-owner membership, invites/requests) + time-based reaper

[RagingRedRiot]

Summary

Builds out the room subsystem on top of the existing users/messages schema, and adds a background reaper so room-related data can't accumulate unbounded. Two commits:

1. Rooms — room lifecycle, a multi-owner membership model, room visibility, and the two ways into a private room (request-to-join and invite).
2. Reaper — a time-based maintenance loop that ages out messages, empty rooms, and stale invites/join requests.

Everything is client-facing and wired end to end (client → server dispatch → room actor → Postgres).

Schema

(init migration edited in place — no release exists yet)

• rooms: add is_public / is_discoverable, drop owner_id.
• memberships: add is_owner and joined_at, with a partial index on owners.
• New room_invites and room_join_requests (pending rows, created_at, ON DELETE CASCADE; invited_by is ON DELETE SET NULL for audit).

Access-control model

Enforced in the actor (SQL can't assert it cheaply):

• An owner is always a member. A room may have zero owners (e.g. after its sole owner is deleted) — allowed, because every owner-gated action also permits admins, so an ownerless room stays manageable. DeleteUser no longer escalates owned rooms to the default admin.
• Visibility drives joining: public → join now; private + discoverable → queue a join request; private + non-discoverable → invite-only, reported as NoRoomExists so existence stays hidden.
• Existence hiding: read gets return NoRoomExists for an unauthorized private room (indistinguishable from a missing one); owner-gated mutations collapse "no such room" and "not authorized" both to Failed.
• No PK leak: membership listings use a user_id-free PublicUser shape; request/invite views are name-only.

Commands

• NewRoom, AddRoomOwner, SetRoomName
• GetRoom, GetRoomMembership
• JoinRoom, LeaveRoom
• Join requests: ApproveJoinRequest, RejectJoinRequest, GetMyJoinRequests, GetIncomingJoinRequests
• Invites: InviteToRoom, AcceptInvite, DeclineInvite, GetMyInvites

The owner-or-admin gate is a single gate_room() helper.

Reaper

• One transaction deletes, all past retention_days: old messages, empty rooms whose id (uuidv7) predates the window, and stale room_invites / room_join_requests.
• Config: retention_days and reap_interval_secs (defaults 30d / hourly), both optional env vars.
• Spawned from main alongside auth, on the shared shutdown token.

Test plan

• cargo test — 124 passing (41 new room/reaper tests + existing suite), via #[sqlx::test] per-test databases.
• New test files: new_room, add_room_owner, set_room_name, get_room, get_room_membership, join_leave, join_requests, invites, reaper — each covering happy path, authorization, idempotency/NoChange, and existence-hiding; a wire-level test asserts membership payloads carry no user_id.
• cargo fmt --all --check and cargo clippy --all-targets -- -D warnings clean.

Notes / follow-ups

• A single retention_days governs every table; a separate, shorter window for pending invites/requests can be added later as an additive knob.
• Message send/broadcast is still TODO and out of scope here.