Let friends invite each other into active rooms

## Goal

Let a user turn an existing friendship into a race by sending a safe, actionable room invitation.

## Product contract

- A user may invite an accepted friend while the inviter is actively in the room.
- Any participant may invite a friend to a public room.
- Only the room owner/current admin may grant a private-room invitation.
- One active invite per room/invitee is deduplicated; resending refreshes the existing invitation rather than spamming duplicates.
- Invites expire after a documented short TTL and immediately become invalid when the room is deleted/hidden, the inviter loses authority, either user blocks the other, or the invite is revoked.
- The recipient can join or decline from the notification/friends UI.
- A private-room invite may bypass the password only for the exact authenticated invitee and room. It never bypasses bans, revealed-identity requirements, room availability, or server-side join checks.

## Data and API

Use a durable typed room-invite resource with inviter, invitee, room, state, expiry, and response timestamps. Notification records reference this resource; notification actions do not contain arbitrary callbacks. Use an opaque invite identifier in deep links and validate the authenticated recipient on every operation.

Coordinate the access-grant path with #156 so private-room approval and friend invitations do not become two incompatible authorization systems.

## Acceptance criteria

- [ ] Add create/list/decline/revoke/consume operations with idempotent state transitions and explicit authorization.
- [ ] Persist invites in MongoDB and add the corresponding non-blocking PostgreSQL mirror/migration.
- [ ] Create a typed in-app notification and realtime event without exposing room passwords or private room membership.
- [ ] Make successful joining consume the invite atomically enough to prevent replay while remaining retry-safe.
- [ ] Give clear UI feedback for expired, revoked, deleted-room, blocked, banned, and no-longer-authorized cases.
- [ ] Add tests for public/private rooms, owner/admin changes, duplicate sends, expiry, blocking, bans, identity requirements, replay, and reconnect.
- [ ] Add a two-user Cypress flow for invite → notification → join.

## Dependencies

- #75
- #105
- #153
- Related: #156

## Non-goals

- Anonymous invite links.
- Inviting arbitrary non-friends.
- Sharing or revealing private-room passwords.

Inizia tracciando il percorso di concessione dell'accesso alla room da #156 e la friends/notification UI, quindi esamina i requisiti di persistenza MongoDB e del mirror PostgreSQL. Verifica le operazioni create, list, decline, revoke e consume rispetto ai criteri di autorizzazione e idempotenza. Concludi con il flusso invite-to-join di Cypress con due utenti e i casi elencati di scadenza, blocco, ban, replay e riconnessione.

Scritto dal modello di indicizzazione a partire dal testo della issue.