fix(share): explicit consent for private→team vault conversion, and make the chosen role reach the invitee

[kipavy]

Closes part of #68.

What this does

Replaces the silent private→team vault conversion with an explicit consent moment, and fixes three real defects found while driving the running app against a live server.

The conversion is no longer a side effect

Adding one person to a private vault used to create a team, link the vault, initialise a vault key and convert the vault to cloud-synced — with no dialog and no explanation. Inviting someone now opens a modal that states the three costs before anything happens:

• Opens only while Voltius can reach the sync server — no offline access.
• Everyone you add gets a copy of its key. Removing them later doesn't take it back.
• There's no way back to private.

PrivateVaultInvitePanel is deleted. A private vault now goes consent → convert → the existing team invite panel, which removes the second invite panel without changing the Members page layout.

Bugs fixed

The chosen role never reached the invitee. addMemberById creates a pending invitation, not a member row, so the follow-up assignMemberRole 404s — and it was swallowed by an empty catch. Every invitee silently landed on the default role. The role is now passed to addMemberById, which the server stores on the invitation; role assignment happens only for someone who is already a member. Reproduced against a live server before fixing:

POST /v1/teams/…/members              → 201  "Pending invitation created for existing user"
POST /v1/teams/…/members/<user>/roles → 404

Failed invites reported success. The invite handler caught all errors, then unconditionally cleared the typed query and told its parent an invite had happened. On failure the query now survives so the user can retry, and the named error toast is the only report.

Seats rendered ? available · ? total when the subscription load failed. There is now an explicit unavailable state.

Smaller fixes

• Text on accent backgrounds used a hardcoded #08151b, which is unreadable under a dark accent. Now uses --t-on-accent, which is computed from accent luminance.
• The vault header's member avatar stack was hover-only with cursor-default — unreachable by keyboard and on touch. It is now a real focusable button with aria-haspopup/aria-expanded and Enter/Space handling. The + affordance itself is unchanged.
• markTeamVaultLoadedAfterLocalActivation was imported from the wrong module; the test mocked the whole path so it passed while production would have thrown.

Not in this PR

• Vault invite links and open grant links (Explicit "Share" verb for vaults — a real share sheet, and unify the two invite panels #68's link half) — they need a server-side grant object and a surface decision.
• The welcome moment for a new joiner (Vault join & first-access experience — welcome moment + honest 'waiting for owner key' state #70).

Verification

Full suite: 508 files, 3911 tests, exit 0. tsc --noEmit exit 0.

Driven end to end in the headless build against a throwaway server: consent → convert → invite, with the invitation's role confirmed in the database as the role chosen in the UI rather than the default.