refactor: purge legacy server_members.role column, single source of truth via member_roles

Remove the legacy TEXT role column ('owner'/'admin'/'member') from
server_members and make the bitwise RBAC member_roles junction table
the sole authority for role assignments. Owner detection now uses
servers.ownerId exclusively.

- Remove MemberRole type and role field from shared types
- Remove role from Drizzle schema, raw SQL CREATE TABLE, and seed data
- Rewrite PATCH /members/:uid to accept { roleIds: string[] }
- Fix GET /members to populate roles array (was TODO)
- Replace member.role === 'owner' guard with isServerOwner()
- Remove getMemberRole() helper and legacy bridge code
- MemberSidebar groups by highest-positioned role instead of legacy string
- ServerSettings replaces admin/member dropdown with role checkboxes
- Message.tsx derives color from roles[] with owner fallback via ownerId
- Existing DBs keep vestigial column (Drizzle ignores it); new DBs omit it

packages/server/src/db/index.ts

@@ -38,7 +38,6 @@ function createTables(db: Database.Database): void {
     CREATE TABLE IF NOT EXISTS server_members (
       server_id TEXT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
       user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-      role TEXT DEFAULT 'member',
       nickname TEXT,
       joined_at INTEGER NOT NULL,
       PRIMARY KEY (server_id, user_id)

packages/server/src/db/schema.ts

@@ -23,7 +23,6 @@ export const servers = sqliteTable('servers', {
 export const serverMembers = sqliteTable('server_members', {
   serverId: text('server_id').notNull().references(() => servers.id, { onDelete: 'cascade' }),
   userId: text('user_id').notNull().references(() => users.id, { onDelete: 'cascade' }),
-  role: text('role').default('member'),
   nickname: text('nickname'),
   joinedAt: integer('joined_at').notNull(),
 }, (table) => ({

packages/server/src/db/seed.ts

@@ -39,7 +39,6 @@ export async function seedDatabase(): Promise<void> {
   db.insert(schema.serverMembers).values({
     serverId: serverId,
     userId: adminId,
-    role: 'owner',
     joinedAt: Date.now(),
   }).run();