fix(spaces): clearer 403 for non-members on invite endpoint (#14)

Non-members already can't mint invite codes (permissions resolve to zero for them since 85e1975f), but hasPermission reports it as a missing CREATE_INVITE permission, which is misleading. Return 'Space membership required' for the non-member case instead.

Message wording from #12 by BadAtCaptchas.

Co-authored-by: BadAtCaptchas <2359196+BadAtCaptchas@users.noreply.github.com>

packages/server/src/routes/spaces.ts

@@ -561,6 +561,12 @@ export async function spaceRoutes(app: FastifyInstance): Promise<void> {
     }
 
     if (!hasPermission(request.userId, id, PermissionBits.CREATE_INVITE)) {
+      // Owners and instance admins always pass hasPermission, so anyone who lands
+      // here is either a non-member or a member without CREATE_INVITE. Give the
+      // non-member a clearer "go join first" message instead of a permission error.
+      if (!isMember(id, request.userId)) {
+        return reply.code(403).send({ error: 'Space membership required', statusCode: 403 });
+      }
       return reply.code(403).send({ error: 'Missing CREATE_INVITE permission', statusCode: 403 });
     }