feat(collections): per-member permission roles on shared lists (#1081)

The owner now assigns each member a role — viewer (read + copy-to-trip only),
editor (default: add + edit places) or admin (full incl. delete). The owner is
always full. Existing members default to editor via migration 152, so nothing
regresses.

- Server: role column on collection_members (migration 152 + schema); roleOf +
  assertCanEdit (save/update/status/list-meta) + assertCanDelete (delete) layered
  on assertAccess; sendInvite takes a role; new setMemberRole (owner-only) +
  POST members/role; members payload carries each role.
- Client: Share modal gains a role picker on invite and a per-member role select
  for the owner (read-only role badge for others); the page hides add / edit /
  status / move / delete for roles that can't perform them (server still enforces).
- Roles in all 22 locales; service + controller tests for the new gating.

client/src/api/collections.ts

@@ -12,6 +12,7 @@ import type {
   CollectionPlaceUpdateRequest,
   CollectionCopyToTripRequest,
   CollectionInviteRequest,
+  CollectionRole,
   CollectionInviteActionRequest,
   CollectionInviteCancelRequest,
   CollectionStatus,
@@ -76,8 +77,10 @@ export const collectionsApi = {
   membership: (params: MembershipQuery): Promise<CollectionMembership> =>
     ax.get(`${base}/membership`, { params }).then((r: AxiosResponse) => r.data),
 
-  invite: (collectionId: number, userId: number): Promise<unknown> =>
-    ax.post(`${base}/invite`, { collection_id: collectionId, user_id: userId } satisfies CollectionInviteRequest).then((r: AxiosResponse) => r.data),
+  invite: (collectionId: number, userId: number, role?: CollectionRole): Promise<unknown> =>
+    ax.post(`${base}/invite`, { collection_id: collectionId, user_id: userId, role } satisfies CollectionInviteRequest).then((r: AxiosResponse) => r.data),
+  setMemberRole: (collectionId: number, userId: number, role: CollectionRole): Promise<unknown> =>
+    ax.post(`${base}/members/role`, { collection_id: collectionId, user_id: userId, role }).then((r: AxiosResponse) => r.data),
   acceptInvite: (collectionId: number): Promise<unknown> =>
     ax.post(`${base}/invite/accept`, { collection_id: collectionId } satisfies CollectionInviteActionRequest).then((r: AxiosResponse) => r.data),
   declineInvite: (collectionId: number): Promise<unknown> =>