Require invitations for trip contributions - #16

What changed

• removes automatic membership enrollment when any visitor signs in
• drops the legacy self-enrollment RPC through an idempotent migration and recovery schema
• preserves public trip reads and all existing member/admin access
• keeps admin email-based member grants as the contribution path
• labels signed-in nonmembers as view-only and updates setup documentation
• adds regression coverage for the access contract

Why

The intended policy is public viewing with editing limited to the friends who were on the trip. Previously, every signed-in visitor silently became a member and therefore gained photo/note contribution rights.

Deployment

Apply 20260711120000_invite_only_contributions.sql to Supabase. Existing members are not changed. A new contributor signs in once, an admin adds their email from Members, and the contributor reloads.

Validation

• npm run lint (0 errors; one pre-existing hook dependency warning)
• npm run typecheck
• npm test (215 tests)
• npm run test:e2e (7 tests)
• git diff --check

Manual smoke test

Verify anonymous viewing, a signed-in uninvited account showing view-only controls, an existing member retaining upload/note controls, and an admin granting a newly authenticated email from Members.