feat: manage pool membership in Space

[osolmaz]

Summary

Pool owners had to edit Space environment variables to add friends.
This change moves day-to-day membership management into the Space itself.
Admins can now add members, remove members, and promote or demote admins from the web UI, while bootstrap Space variables remain as recovery access.

What Changed

Membership is now durable data in the private dataset instead of only runtime environment config.
The Space loads config/pool.json, falls back to bootstrap variables when needed, and commits membership edits through the existing dataset token.

• Added dataset metadata read/write support and a PoolMembership service.
• Added admin API routes for reading the pool config and changing members/admins.
• Updated OAuth, /connect, ingest, explorer APIs, and /api/me to use the shared membership source.
• Added an Admin tab in the explorer for admins.
• Updated setup to set POOL_ADMINS and docs to describe the new flow.

Testing

I tested the backend membership behavior, the frontend admin flow, and the full repo gate locally.
The production Space deployment still needs to rebuild from this branch after merge before the Admin tab is live there.

• npm run test --workspace space passed.
• npm run test --workspace explorer passed.
• npm run typecheck --workspace setup passed.
• npm run check passed.
• npm run build passed.

Risks

The main risk is membership migration from the existing ALLOWED_USERS variable.
The code keeps a bootstrap fallback: when config/pool.json does not exist, the current allowed users become initial members and POOL_ADMINS or the first allowed user becomes admin.

• Existing pool members keep working before the first admin edit.
• Once the admin UI writes config/pool.json, that file becomes the source of truth for ordinary members.
• Bootstrap admins always remain admins until POOL_ADMINS is changed in Space variables.

[osolmaz]

Final report:

• Implemented dataset-backed pool membership, admin APIs, setup support for POOL_ADMINS, and the Space Admin UI.
• Addressed Codex review P1s by treating the real Hub missing-config error as bootstrap fallback and keeping in-memory membership unchanged until config commits succeed.
• Local validation passed:
  • npm run test --workspace space passed: 9 files, 78 tests.
  • npm run check passed: format, lint, typecheck, 23 Vitest files / 149 tests, extension tests / 66 tests, native tests / 41 tests, coverage, and slophammer dry.
  • npm run build passed for explorer, space, and setup.
  • git diff --check passed.
• codex review --base main is clean after fixes: no actionable correctness issues.
• GitHub CI check passed on head 6ef33bd768aa7a931dd5643140cf72cd7f7fd1b7.

Merging autonomously as requested.