Let friends invite each other into active rooms

[coder13]

Goal

Let a user turn an existing friendship into a race by sending a safe, actionable room invitation.

Product contract

• A user may invite an accepted friend while the inviter is actively in the room.
• Any participant may invite a friend to a public room.
• Only the room owner/current admin may grant a private-room invitation.
• One active invite per room/invitee is deduplicated; resending refreshes the existing invitation rather than spamming duplicates.
• Invites expire after a documented short TTL and immediately become invalid when the room is deleted/hidden, the inviter loses authority, either user blocks the other, or the invite is revoked.
• The recipient can join or decline from the notification/friends UI.
• A private-room invite may bypass the password only for the exact authenticated invitee and room. It never bypasses bans, revealed-identity requirements, room availability, or server-side join checks.

Data and API

Use a durable typed room-invite resource with inviter, invitee, room, state, expiry, and response timestamps. Notification records reference this resource; notification actions do not contain arbitrary callbacks. Use an opaque invite identifier in deep links and validate the authenticated recipient on every operation.

Coordinate the access-grant path with #156 so private-room approval and friend invitations do not become two incompatible authorization systems.

Acceptance criteria

• Add create/list/decline/revoke/consume operations with idempotent state transitions and explicit authorization.
• Persist invites in MongoDB and add the corresponding non-blocking PostgreSQL mirror/migration.
• Create a typed in-app notification and realtime event without exposing room passwords or private room membership.
• Make successful joining consume the invite atomically enough to prevent replay while remaining retry-safe.
• Give clear UI feedback for expired, revoked, deleted-room, blocked, banned, and no-longer-authorized cases.
• Add tests for public/private rooms, owner/admin changes, duplicate sends, expiry, blocking, bans, identity requirements, replay, and reconnect.
• Add a two-user Cypress flow for invite → notification → join.

Dependencies

• Build the friend request, friendship, and blocking lifecycle #75
• Add a typed in-app notification inbox for social actions #105
• Host ownership should survive disconnects and rejoins #153
• Related: Add private room join and spectator approval flow #156

Non-goals

• Anonymous invite links.
• Inviting arbitrary non-friends.
• Sharing or revealing private-room passwords.