[Team] Authenticate individual team members and revoke sessions #48

Planning ID: TODO-C

Proposed issue / PR title: feat(auth): add member sign-in and revocable team invitations.

Goal: give the server a trusted human actor for each request and connection.

Scope: a minimal supported sign-in/session flow, expiring single-use team invitations, member removal, session revocation and authenticated actor propagation to core handlers. Reuse the host’s supported authentication facilities where suitable; do not invent custom cryptography. Define how an existing installation is bootstrapped into its first authenticated owner.

Out of scope: SSO/SCIM and public signup.

Dependencies: TODO-B (#47).

Code area: core API/channel integration, client onboarding and the host-auth integration seam; verify the actual DSH facilities before selecting implementation details.

Acceptance and tests: two browsers have different member identities; forged client actor IDs have no effect; invitation replay/expiry fails; removal invalidates existing sessions and live subscriptions. Keep shared-team operation disabled until TODO-D’s authorization lands.

Delivery

One focused implementation PR for this issue. This is planned work, not a claim of shipped multi-human support. Preserve the pristine upstream pin and generated patch/client boundaries. Keep team mode disabled until the documented authorization gates pass. Record exact tested head, executed checks, missing checks and independent review. No production credentials or live deployment are part of this issue.