Add campaign team collaboration and public API v1 platform.

[Abidoyesimze]

Summary

• Campaign Team Collaboration — Multi-Member Roles & Permissions #248 — Campaign team collaboration: Adds campaign_members with invite/resend/cancel flows (7-day token expiry), role-based permissions (owner, manager, editor, viewer), a Team tab on the campaign dashboard, and an invite preview on AcceptInvite.jsx.
• Public Payments API — Programmatic Campaign Contributions for Developers #249 — Public API platform: Ships versioned /api/v1 and /v1 endpoints with Bearer cp_live_* API key auth, 100 req/min rate limiting, Stellar tx-hash contribution recording, OpenAPI docs at /v1/docs, and a live API explorer on the Developer page.

Closes #248
Closes #249

Backend

Team & invites (#248)

• Migration: backend/db/migrations/20260527_campaign_members.sql
• POST /api/campaigns/:id/members/invite — email invite with 7-day token
• GET /api/invites/:token — invite preview (campaign name + role)
• POST /api/invites/:token/accept — accept invitation
• POST /:id/members/:memberId/resend, DELETE /:id/members/invites/:memberId — pending invite management
• PATCH /:id/members/:userId (owner only), DELETE /:id/members/:userId (last-owner guard)
• Role enforcement: managers post updates; editors edit content; viewers see analytics; editors cannot access analytics
• GET /campaigns/:id resolves user_role from session cookie

Public API (#249)

• GET /v1/campaigns, GET /v1/campaigns/:id
• GET/POST /v1/campaigns/:id/contributions (Horizon-verified Stellar tx)
• GET /v1/users/me
• POST /api/auth/api-keys alias alongside /api/api-keys
• OpenAPI at /v1/docs and /api/v1/docs

Frontend

• Campaign.jsx: Team tab with role badges, editor role in invite dropdown, pending invite Resend/Cancel, role-gated analytics and update posting
• AcceptInvite.jsx: Shows campaign title and assigned role before confirming
• Developer.jsx: API key management + live v1 API explorer + OpenAPI link

Test plan

• Run migration: psql $DATABASE_URL -f backend/db/migrations/20260527_campaign_members.sql
• Owner invites a manager by email; invitee receives link, sees preview, accepts, appears in Team list
• Manager can post campaign update; editor cannot view analytics
• Owner can resend/cancel pending invites; cannot remove last owner
• Create API key on Developer page; call GET /api/v1/campaigns unauthenticated (200)
• Call GET /api/v1/users/me without key (401); with Bearer cp_live_… (200)
• POST /api/v1/campaigns/:id/contributions with valid Stellar tx hash creates contribution
• Open /v1/docs and verify OpenAPI spec loads
• cd backend && npm test — campaignPermissions.test.js, v1.test.js, authScopes.test.js