Add team management endpoints

- Three-role model (owner/admin/member) with owner protection invariants
- Team CRUD: create, rename (admin+), soft-delete with VM cleanup (owner only)
- Member management: add by email, remove, role updates (admin+), leave
- Switch-team endpoint re-issues JWT after DB membership verification
- User email prefix search for add-member UI autocomplete
- JWT carries role as a hint; all authorization decisions verified from DB
- Team slug: immutable 12-char hex (e.g. a1b2c3-d1e2f3), reserved on soft-delete
- Migration adds slug + deleted_at to teams; backfills existing rows

db/migrations/20260324071453_team_management.sql

@@ -0,0 +1,17 @@
+-- +goose Up
+
+ALTER TABLE teams ADD COLUMN slug TEXT;
+ALTER TABLE teams ADD COLUMN deleted_at TIMESTAMPTZ;
+
+-- Backfill slugs for existing teams using MD5 of their ID.
+-- MD5 returns 32 hex chars; take chars 1-6 and 7-12 to form a 6-6 slug.
+UPDATE teams SET slug = LEFT(MD5(id), 6) || '-' || SUBSTRING(MD5(id), 7, 6);
+
+ALTER TABLE teams ALTER COLUMN slug SET NOT NULL;
+CREATE UNIQUE INDEX idx_teams_slug ON teams(slug);
+
+-- +goose Down
+
+DROP INDEX idx_teams_slug;
+ALTER TABLE teams DROP COLUMN deleted_at;
+ALTER TABLE teams DROP COLUMN slug;