feat(dashboard): team members page with add and remove

[harshtandiya]

What changed

Fourth in the /manage stack. #351 has merged, so this sits directly on develop.
Fills in the sidebar's Members item, which fell through to the work-in-progress
placeholder until now.

• /manage/team/members — the team as a subtle table: name, email, role, and an
  ellipsis menu holding the one destructive action. Owner sorts first and carries no
  menu, matching the controller lock. A legend above it spells out what each of the
  five roles can actually do.
• remove_member — disables the membership rather than deleting it, so
  upsert_membership re-enables the same row if the person is invited back.
• invite_members + an Add members dialog — rows of email and role, a pasted
  comma-separated list explodes into rows, and the next row opens as you type.
• Pending invitations sit in the same table, address standing in for the name and
  (Invited) against the role.

Worth knowing

Invite-by-email existed and had never been called. 00-teams/04 wired the
user_invitation hook, the buzz_team/buzz_team_role custom fields and
on_invitation_accepted, but the only caller was EventTicket.send_user_invitation,
and that call site is commented out. This is the first path that actually sends one.

invite_members does not just forward to core. invite_by_email skips any address
that ever accepted a buzz invitation, filtered by app_name with no team filter — so
inviting a colleague to a second team would silently no-op and report success. Existing
users go through upsert_membership instead; only strangers get an email.

Guarded at invite time, not accept time. Core's validate_role gates on the Frappe
role, not team membership, so a Manager could otherwise create an invitation that throws
when the recipient clicks the link. can_manage_members runs before anything is sent.
The three refusal tests were mutation-checked: if False: breaks exactly those.

Accepting a Manager/Admin/Frontdesk invitation makes the user a System User. Event Manager and Frontdesk Manager both carry desk_access, and set_system_user() flips
user_type on any save. Pre-existing and deliberate — 00-teams/01 deferred an Event Manager fixture because desk_access: 0 would revoke Desk from every current organizer
— but this PR makes it one click away, so it is worth naming. Not addressed here.

Not in scope

Role changes, revoking an invitation (core's cancel_invitation would slot into the same
menu), leaving a team, and the team profile/settings surface — all spec 13, all separate.

Demo

https://cap.so/s/rb0k446j8jz7scj

Testing

32 new backend tests across test_teams.py and test_invitations.py, plus a Playwright
spec for the route and the owner row. Verified in a browser with five members and pending
invitations: remove, paste, add, and every toast variant.

Rebased onto develop after #351 squash-merged: 7 commits to 4, the three #351 commits
dropped. No content change — pre-commit clean on all 15 files, typecheck clean, 70 unit
tests, 32 backend tests green.

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

The PR adds the team-members management page and its supporting invitation and removal APIs.

• Lists active members and pending invitations with role details.
• Adds guarded member removal and batch invitation flows.
• Adds dashboard routing, shared response types, backend coverage, and a members-page browser test.

Confidence Score: 4/5

The PR does not yet appear safe to merge because an older overview request can still replace the currently selected team's roster.

The shared team-overview resource accepts overlapping reloads without tying each result to its initiating team, so switching teams can leave the members page displaying the previous team's data.

Files Needing Attention: dashboard/src/data/teams.ts, dashboard/src/pages/manage/teams/TeamMembers.vue

Important Files Changed

Filename	Overview
dashboard/src/data/teams.ts	Adds member-management resources while retaining the outstanding shared overview-resource race across team switches.
dashboard/src/pages/manage/teams/TeamMembers.vue	Implements the members table, management controls, and refresh behavior, but still renders overview data that can belong to a previously selected team.
dashboard/src/components/dashboard/teams/AddMembersDialog.vue	Implements validated multi-row invitations, pasted-address expansion, role selection, and outcome reporting.
buzz/api/teams/invitations.py	Adds authorization and role validation before routing existing users to membership upsert and new users to email invitations.
buzz/api/teams/services.py	Extends team overviews with pending invitations and adds guarded soft removal of memberships.
e2e/tests/team-members.spec.ts	Covers route rendering and the protected owner row without introducing a blocking issue.

_{Reviews (6): Last reviewed commit: "feat(dashboard): add members and show wh..." | Re-trigger Greptile}

[greptile-apps]

Stale responses replace current team

If two team overview requests overlap, the older request can finish last and overwrite the shared teamOverview.data, causing the members page to display the previous team's roster and pending invitations under the newly selected team.

Prompt To Fix With AI

This is a comment left during a code review.
Path: dashboard/src/pages/manage/teams/TeamMembers.vue
Line: 29

Comment:
**Stale responses replace current team**

If two team overview requests overlap, the older request can finish last and overwrite the shared `teamOverview.data`, causing the members page to display the previous team's roster and pending invitations under the newly selected team.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[github-actions]

✅ UI Demo Check — a screenshot or demo is attached.