Phase 2: private rooms, room roles, and invites (backend only)

Adds room_invites table + migration, owner/admin/member role enforcement
(require_room_role), and endpoints for private room creation, room
management (update/delete/leave/transfer-ownership/change-role/remove-member),
and the invite lifecycle (create/list/accept/decline/revoke). Registration
stays invite-only via the CLI from Phase 1 — this is a separate, room-level
invite system for adding existing users to private rooms.

Frontend is untouched: the UI redesign is happening separately, so this phase
is backend + tests only (35 passing). Verified no regressions in the Phase 1
open-room/WebSocket flow via manual smoke test.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/app/schemas/invite.py

@@ -0,0 +1,22 @@
+import uuid
+from datetime import datetime
+
+from pydantic import BaseModel, ConfigDict, Field
+
+from app.models import InviteStatus
+
+
+class InviteCreate(BaseModel):
+    target_username: str = Field(min_length=1)
+
+
+class InviteRead(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: uuid.UUID
+    room_id: uuid.UUID
+    invited_by: uuid.UUID
+    target_user_id: uuid.UUID | None
+    status: InviteStatus
+    expires_at: datetime
+    created_at: datetime

backend/app/schemas/room.py

@@ -3,10 +3,18 @@ from datetime import datetime
 
 from pydantic import BaseModel, ConfigDict, Field
 
+from app.models import RoomRole
+
 
 class RoomCreate(BaseModel):
     name: str = Field(min_length=1, max_length=100)
     description: str | None = Field(default=None, max_length=2000)
+    is_private: bool = False
+
+
+class RoomUpdate(BaseModel):
+    name: str | None = Field(default=None, min_length=1, max_length=100)
+    description: str | None = Field(default=None, max_length=2000)
 
 
 class RoomRead(BaseModel):
@@ -22,3 +30,22 @@ class RoomRead(BaseModel):
 
 class RoomListItem(RoomRead):
     is_member: bool
+
+
+class MyRoomItem(RoomRead):
+    role: RoomRole
+
+
+class RoomMemberRead(BaseModel):
+    user_id: uuid.UUID
+    username: str
+    role: RoomRole
+    joined_at: datetime
+
+
+class RoomMemberRoleUpdate(BaseModel):
+    role: RoomRole
+
+
+class TransferOwnershipRequest(BaseModel):
+    new_owner_user_id: uuid.UUID