Phase 4 backend: teams data layer + membership management

- Migration 0003: teams + team_memberships (owner/admin/member, seat_limit)
- POST /v1/teams (Team-tier gated), GET /v1/teams/{id},
  GET|POST /v1/teams/{id}/members, DELETE …/members/{userId}
- Add-by-email (existing accounts), seat-cap enforcement (402), role-based
  authorization (admin to mutate; non-members get 404; owner unremovable)
- Invite notification email; Tier::can_own_team()

100 backend tests; fmt + clippy clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

cardclaws-backend/crates/cardclaws-types/src/user.rs

@@ -42,6 +42,11 @@ impl Tier {
         !matches!(self, Tier::Free)
     }
 
+    /// Only Team/Enterprise tiers can own a team (PRD §19.1).
+    pub fn can_own_team(self) -> bool {
+        matches!(self, Tier::Team | Tier::Enterprise)
+    }
+
     /// Analytics retention window in days; `None` = unlimited (PRD §19.1).
     pub fn analytics_retention_days(self) -> Option<i64> {
         match self {