Let Members Leave Projects

[thehabes]

Closes #414

This PR implements the ability for members to voluntarily leave projects via a new POST /project/:projectId/leave endpoint. It also adds the removeMember functionality to the Group and Project classes with proper safeguards.

Changes

• New endpoint: POST /project/:projectId/leave - Allows authenticated members to leave a project
• Group.removeMember(): New method to remove members from groups with owner protection
• Group.getGroupsByMember(): New static method to find all groups containing a member
• Project.removeMember(): Updated to handle voluntary leaving vs admin removal, sends confirmation emails

Features

• Members can leave projects they belong to
• Only-OWNER protection prevents orphaning projects (returns 403 with clear message)
• Confirmation emails sent to removed members (voluntary vs admin removal have different messages)
• Proper cleanup of temporary/invited users when they have no remaining group memberships

Test Plan

• Member can leave a project they belong to (200 OK)
• Request without authentication returns 401
• Invalid/non-existent project ID returns 404
• User not a member of project returns 400
• Only OWNER cannot leave - returns 403 "Transfer ownership first"
• Admin can remove members via existing /remove-member endpoint
• App remains stable - no crashes on error conditions

Notes

Does not do #416. That will be its own PR.

[cubap]

Since OWNER can do everything, I think no LEADER is okay.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.