Invitation Decline/Upgrade Use GET for State Changes

**Files:**
- `project/memberDeclineInviteRouter.js:16`
- `project/memberUpgradeRouter.js:23`

**Severity:** HIGH

**Issue:** Both endpoints use HTTP GET method for operations that modify state (delete users, update groups). This violates REST principles and HTTP specifications.

```javascript
router.route("/:projectId/collaborator/:collaboratorId/decline").get(async (req, res) => {
// Deletes user from database!
```

**Impact:**
- GET requests can be triggered by browser prefetch, crawlers, or link previews
- Operations not idempotent (clicking link twice causes errors)
- Violates HTTP specification (GET should be safe operations)
- Security risk: CSRF attacks possible

**Fix:** Change to POST or DELETE method:
```javascript
router.route("/:projectId/collaborator/:collaboratorId/decline").post(async (req, res) => {
// Or .delete() for decline
```

**Note:** Frontend code will also need updating to use POST instead of GET.

Start with project/memberDeclineInviteRouter.js:16 and project/memberUpgradeRouter.js:23, then inspect the frontend callers that invoke these routes. Confirm the intended POST or DELETE method for each state-changing operation and update both sides consistently. Done means the routes no longer use GET and their callers use the matching method.

Written by the indexing model from the issue text.