fix(permissions): deny space permissions to non-members (invite-bypass)

computePermissions() returned the space @everyone role's permissions without
verifying the caller had joined the space. Because CREATE_INVITE is in
DEFAULT_EVERYONE_PERMISSIONS, any authenticated user could mint an invite code
for a request-only space — whose id is listed by /api/spaces/explore — and then
self-join via /api/spaces/:id/join, bypassing the join-request approval flow.
The same gap let non-members read message history and search default channels.

Root cause:
- computePermissions now returns 0n for non-members (space owner and instance
  admin still short-circuit first, so they are unaffected).

Defense in depth (request-only spaces are approval-gated, never invite-joinable):
- both invite-code join endpoints reject visibility='request' (private stays
  invite-joinable — its only entry path; public too).
- POST /api/spaces/:id/invite refuses to hand out a code for request spaces.
- POST /api/dm/space-invite refuses to card a local request space, checked by
  space id against the local table so a spoofed spaceInstanceOrigin can't slip
  past it.
- InviteModal hides the invite affordances for request spaces.

Also removes the unused computeCategoryPermissions(), which duplicated the
resolution algorithm without the membership gate.

Adds unit + route + component tests covering non-member/member/owner/admin
resolution and the request/private/public visibility matrix.

Reported-by: BadAtCaptchas (#2)

packages/server/src/routes/dm.spaceInvite.test.ts

@@ -200,6 +200,57 @@ describe('POST /api/dm/space-invite', () => {
     expect(messageCount).toBe(0);
   });
 
+  it('rejects a space invite for a local request-only space (approval required)', async () => {
+    // Real local space with request visibility; the snapshot is mocked to match.
+    testDb.insert(schema.spaces).values({
+      id: 'S-REQ', name: 'Req', ownerId: 'alice', inviteCode: 'reqcode',
+      visibility: 'request', createdAt: 1,
+    }).run();
+    (getLocalInviteSnapshot as unknown as ReturnType<typeof vi.fn>).mockReturnValueOnce({
+      spaceId: 'S-REQ', spaceName: 'Req', description: null, icon: null,
+      avatarColor: null, memberCount: 1, instanceName: 'Backspace',
+    });
+    const res = await app.inject({
+      method: 'POST',
+      url: '/api/dm/space-invite',
+      payload: {
+        target: { userId: 'bob' },
+        spaceId: 'S-REQ',
+        spaceInstanceOrigin: '',
+        inviteCode: 'reqcode',
+      },
+    });
+    expect(res.statusCode).toBe(403);
+    // No DM card should be inserted for a request-only space.
+    expect(testDb.select().from(schema.dmMessages).all().length).toBe(0);
+  });
+
+  it('rejects a local request-only space even when spaceInstanceOrigin is spoofed to look remote', async () => {
+    // A caller can send an origin variant (trailing slash / different case) so
+    // `isLocal` is false and the fetch path is taken, but the space is genuinely
+    // local + request. The guard must not depend on the claimed origin.
+    testDb.insert(schema.spaces).values({
+      id: 'S-REQ2', name: 'Req2', ownerId: 'alice', inviteCode: 'reqcode2',
+      visibility: 'request', createdAt: 1,
+    }).run();
+    (fetchSpaceInviteSnapshot as unknown as ReturnType<typeof vi.fn>).mockResolvedValueOnce({
+      spaceId: 'S-REQ2', spaceName: 'Req2', description: null, icon: null,
+      avatarColor: null, memberCount: 1, instanceName: 'Backspace',
+    });
+    const res = await app.inject({
+      method: 'POST',
+      url: '/api/dm/space-invite',
+      payload: {
+        target: { userId: 'bob' },
+        spaceId: 'S-REQ2',
+        spaceInstanceOrigin: 'https://local.test/', // trailing slash defeats strict isLocal compare
+        inviteCode: 'reqcode2',
+      },
+    });
+    expect(res.statusCode).toBe(403);
+    expect(testDb.select().from(schema.dmMessages).all().length).toBe(0);
+  });
+
   it('inserts a type=system message with parseable space_invite content on success', async () => {
     (getLocalInviteSnapshot as unknown as ReturnType<typeof vi.fn>).mockReturnValueOnce({
       spaceId: 'S1',