Phase 3: Roles & permissions enforcement with guards, member management, and admin panel

Centralize permission checks into guards.ts (requireAuth, requireBoardView,
requireBoardEditor, requireBoardOwner, requireColumnEditor, requireCardEditor,
requireBoardMemberManager, requireTenantAdmin) that fetch entities and check
permissions in a single call, replacing ~100 lines of duplicated inline checks
across all API routes. Adds board member management (add by email, change role,
remove with last-owner protection), tenant admin panel (user role toggle with
last-admin protection, board overview), and fixes missing view guard on card GET.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/routes/api/boards/+server.ts

@@ -2,6 +2,7 @@ import { json, error } from '@sveltejs/kit';
 import type { RequestHandler } from './$types.js';
 import { boardSchema } from '$lib/server/validation.js';
 import { withTenant } from '$lib/server/rls.js';
+import { requireAuth } from '$lib/server/guards.js';
 
 // List boards for current tenant
 export const GET: RequestHandler = async ({ locals }) => {
@@ -41,7 +42,7 @@ export const GET: RequestHandler = async ({ locals }) => {
 export const POST: RequestHandler = async ({ request, locals }) => {
 	const tenant = locals.tenant;
 	if (!tenant) throw error(400, 'Unknown tenant');
-	if (!locals.user) throw error(401, 'Not authenticated');
+	requireAuth(locals.user);
 
 	const body = await request.json();
 	const result = boardSchema.safeParse(body);