fix: Invite to Room now creates a pending invitation instead of adding member directly (#3239)

[aaniya22]

Summary

The "Invite to Room" feature previously added a GitHub user as a full room member immediately, with no consent step. This PR introduces a proper pending-invitation flow: invites create a room_invitations record and notify the invitee, who must accept before becoming a member.

Closes #3239

---

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• 🔒 Security fix

---

What Changed

• Added room_invitations table (migration + schema.sql) with pending/accepted/declined status and RLS policy
• src/app/api/rooms/[roomId]/invite/route.ts now creates a pending invitation and sends a notification, instead of calling addRoomMember directly
• Added GET /api/room-invitations to list a user's pending invitations
• Added POST /api/room-invitations/[invitationId] to accept or decline an invitation
• Added src/components/rooms/PendingInvitations.tsx, surfaced on the rooms list page
• InviteModal now shows a pending-confirmation message instead of optimistically closing
• MembersPanel no longer adds the invited user to the members list on invite, since they aren't a member until they accept
• Added RoomInvitation type in src/types/rooms.ts

---

How to Test

1. Log in as User A, create a room, and invite User B by GitHub username
2. Confirm User B is not immediately added as a member, and receives a notification
3. Log in as User B, go to the Rooms page, and confirm the invitation appears under "Pending Invitations"
4. Accept the invitation and confirm User B is now a room member with access to chat history
5. Repeat and decline instead — confirm User B is not added as a member

Expected result: Inviting a user creates a pending invitation and notification; the invited user must explicitly accept before becoming a room member.

---

Screenshots / Recordings

N/A — can add if requested during review.

---

Checklist

• Linked the related issue above
• Self-reviewed my own diff
• No unnecessary console.log, debug code, or commented-out blocks
• npm run lint passes locally
• No TypeScript errors (npm run type-check)
• Added or updated tests where applicable
• Updated documentation / comments if behavior changed

---

Accessibility (UI changes only)

• Keyboard navigation works correctly
• Color contrast meets WCAG AA standard
• ARIA labels / roles added where needed
• Tested on mobile / responsive layout

---

Additional Context

This is a schema change requiring a new migration (supabase/migrations/20260729041910_add_room_invitations.sql) to be applied before merge. No automated tests were added for the new invitation flow yet — existing rooms.test.ts and rooms-messages.test.ts (16 tests) still pass unaffected. Happy to add coverage for the accept/decline endpoints if desired before merge.

[github-actions]

GSSoC Label Checklist 🏷️

@Priyanshu-byte-coder — please apply the appropriate labels before merging:

Difficulty (pick one):

• level:beginner — 20 pts
• level:intermediate — 35 pts
• level:advanced — 55 pts
• level:critical — 80 pts

Quality (optional):

• quality:clean — ×1.2 multiplier
• quality:exceptional — ×1.5 multiplier

Validation (required to score):

• gssoc:approved — counts for points
• gssoc:invalid / gssoc:spam / gssoc:ai-slop — does not score

Type labels (type:*) are auto-detected from files and title. Review and adjust if needed.
Points formula: (difficulty × quality_multiplier) + type_bonus