fix(permissions): deny space permissions to non-members (invite-bypass)

computePermissions() returned the space @everyone role's permissions without
verifying the caller had joined the space. Because CREATE_INVITE is in
DEFAULT_EVERYONE_PERMISSIONS, any authenticated user could mint an invite code
for a request-only space — whose id is listed by /api/spaces/explore — and then
self-join via /api/spaces/:id/join, bypassing the join-request approval flow.
The same gap let non-members read message history and search default channels.

Root cause:
- computePermissions now returns 0n for non-members (space owner and instance
  admin still short-circuit first, so they are unaffected).

Defense in depth (request-only spaces are approval-gated, never invite-joinable):
- both invite-code join endpoints reject visibility='request' (private stays
  invite-joinable — its only entry path; public too).
- POST /api/spaces/:id/invite refuses to hand out a code for request spaces.
- POST /api/dm/space-invite refuses to card a local request space, checked by
  space id against the local table so a spoofed spaceInstanceOrigin can't slip
  past it.
- InviteModal hides the invite affordances for request spaces.

Also removes the unused computeCategoryPermissions(), which duplicated the
resolution algorithm without the membership gate.

Adds unit + route + component tests covering non-member/member/owner/admin
resolution and the request/private/public visibility matrix.

Reported-by: BadAtCaptchas (#2)

packages/server/src/routes/spaces.ts

@@ -564,6 +564,13 @@ export async function spaceRoutes(app: FastifyInstance): Promise<void> {
       return reply.code(403).send({ error: 'Missing CREATE_INVITE permission', statusCode: 403 });
     }
 
+    // Request-only spaces are approval-gated and never joinable by invite code
+    // (see the join endpoints), so they have no usable invite links. Refuse to
+    // hand one out rather than mint a code that would dead-end at the join guard.
+    if (server.visibility === 'request') {
+      return reply.code(403).send({ error: 'Request-only spaces do not use invite links; entry is by join request', statusCode: 403 });
+    }
+
     // Return existing invite code if one exists, otherwise generate a new one
     if (server.inviteCode) {
       return reply.code(200).send({ inviteCode: server.inviteCode });
@@ -605,6 +612,13 @@ export async function spaceRoutes(app: FastifyInstance): Promise<void> {
       return reply.code(409).send({ error: 'You are already a member of this space', statusCode: 409 });
     }
 
+    // Request-only spaces are gated by manager approval: entry must go through
+    // POST /request-join + approval, never a bearer invite code. (Private spaces
+    // remain invite-joinable — that is their only entry path; public too.)
+    if (server.visibility === 'request') {
+      return reply.code(403).send({ error: 'This space requires an approved join request', statusCode: 403 });
+    }
+
     const now = Date.now();
     db.insert(schema.spaceMembers).values({
       spaceId: id,
@@ -661,6 +675,11 @@ export async function spaceRoutes(app: FastifyInstance): Promise<void> {
       return reply.code(409).send({ error: 'You are already a member of this space', statusCode: 409 });
     }
 
+    // Request-only spaces are gated by manager approval (see POST /:id/join).
+    if (server.visibility === 'request') {
+      return reply.code(403).send({ error: 'This space requires an approved join request', statusCode: 403 });
+    }
+
     const now = Date.now();
     db.insert(schema.spaceMembers).values({
       spaceId: server.id,