API: Implement Board contributor management endpoints

[lucianfialho]

Problem

Boards are meant to be collaborative. Currently there are no endpoints to manage contributors (members) on a board, assign roles, or control permissions.

Solution

Implement endpoints for managing board contributors and their roles.

Acceptance Criteria

• POST /api/boards/[id]/members - Add contributor to board

  • Request body: { email: string, role: 'editor' | 'viewer' }
  • Response: { id, userId, boardId, role, joinedAt }
  • Looks up user by email, returns 404 if user not found
  • Prevents duplicate memberships
  • Requires owner role on board

• DELETE /api/boards/[id]/members/[userId] - Remove contributor

  • Returns 204 on success
  • Prevents owner from removing themselves
  • Requires owner role on board
  • Returns 404 if member not found

• PATCH /api/boards/[id]/members/[userId] - Change contributor role

  • Request body: { role: 'editor' | 'viewer' }
  • Response: { id, userId, boardId, role, joinedAt }
  • Requires owner role
  • Prevents changing owner's own role to non-owner

• GET /api/boards/[id]/members - List board members

  • Response: { members: BoardMember[] }
  • Includes role + joinedAt
  • Visible to all board members

Role Model

• owner: Can manage members, add/remove papers, update board
• editor: Can add/remove papers, view full board
• viewer: Can view papers only, cannot edit

Dependencies

• Issue Data Model: Design and implement Board entity and schema #1: Data Model must exist
• Issue API: Implement Board CRUD endpoints #2: Board CRUD endpoints

Notes

• Email-based lookups use existing users table
• Ensure owners cannot be downgraded if they're the last owner
• Log member changes for audit trail (optional for MVP)