implement namespaces workflow

Invitations should be working already, more or less. We need to fill out the namespaces workflow.

First: The two-booleans approach to mark status is not so great. We need a status enum. Valid statuses for namespace_memberships:

- active: has full privileges
- invited: has been asked to join
- inactive: a rejected invitation or removed member is inactive; can be invited again
- banned: cannot be invited again (trying to anticipate a future need here)

Invitations & permissions code will need to be updated;

After that, we can fill out the namespaces feature:
- There should be a way to create namespaces in the cli.
- The api endpoint that creates a namespace should make the logged-in user a member of the namespace.