Remove the owner-only gate on POST /api/dm/:id/members. The S2S relay already accepts member_add from any HMAC-verified peer, and the UI already shows the add button to all group DM members. Only the server-side check was blocking non-owners.