feat(KLEF-138): Project Collaboration

[JeremyNRoos]

Pull Request

Summary

• Fixes ListInvites returning accepted/expired invites (caused 404 on revoke)
• Auto-marks the originating invite notification as read when a project invite is accepted
• Blocks workload creation at the API level for project members with the Viewer role

Related Issues

Closes #

---

Changes

What's Included

• projects/adapters/persistence/store.go — ListInvites now filters accepted_at IS NULL AND expires_at > NOW(), returning only pending invites
• notifications/ports/repository.go — added MarkReadByInviteID(ctx, userID, inviteID) to the repository interface
• notifications/adapters/persistence/store.go — implemented MarkReadByInviteID using the Postgres JSON operator data->>'invite_id' to locate the matching project_invitation notification
• notifications/application/service.go — added MarkReadByInviteID service method delegating to the repository
• projects/adapters/http/handler.go — acceptInvite calls notifications.MarkReadByInviteID after a successful accept, then creates a "You joined a project" notification
• workloads/adapters/http/handler.go — provisionWorkload now checks the caller's project role via GetMember; returns 403 if rank is below Developer

What's Not Included

• Role enforcement on start/stop/restart/delete workload actions — those remain org-level only for now
• Viewer restriction on connection (edge) creation

---

Testing

How Was This Tested?

• Tested ListInvites before/after: accepted invites no longer appear in the pending list
• Verified RevokeInvite no longer returns 404 for an invite that was recently accepted
• Verified the project_invitation notification is marked read immediately after acceptInvite
• Verified a Viewer JWT receives 403 forbidden: requires developer role or higher when calling POST /api/v1/projects/{id}/workloads

Test Coverage

• Unit tests added or updated
• Integration tests added or updated
• Manually tested end-to-end

---

Breaking Changes

• Yes
• No

---

Security Considerations

• This PR affects authentication or authorization logic
• This PR touches secrets, tokens, or environment variables
• This PR affects infrastructure, deployment pipelines, or network configuration

The workload creation endpoint now enforces a minimum project role of Developer. Any caller with a valid JWT but only Viewer membership will receive a 403. Org admins who are not explicit project members are unaffected (they bypass the member check path).

---

Documentation

• Yes
• No

---

UI/UX (If Applicable)

N/A — backend only.

---

Pre-Merge Checklist

• PR title follows semantic format (feat:, fix:, chore:, docs:, refactor:, test:)
• All CI checks passing
• Code follows project style guidelines
• No debug logs or commented-out code left in
• Dependencies reviewed (no unnecessary additions)
• No sensitive information included

---

Reviewer Notes

• MarkReadByInviteID uses data->>'invite_id' (Postgres JSON text extraction). The data column is jsonb, so this is indexed-friendly; no schema change required
• The workload role check is intentionally a best-effort guard (if memberErr == nil && rank < developer) — if GetMember errors (e.g. cross-org user with no explicit membership), the check is skipped and the existing org-ownership check in ProvisionWorkloadCommand still applies