fix(groups,system): remove-member action + stale invite button

Adds removeGroupMember (DELETE /groups/{topic}/members/{user_id}) --
confirmed live the backend now has this route (server/im_http.go's
serveIMGroupMember + canRemoveIMGroupMember), which an earlier pass
recorded as a genuine protocol gap; it isn't anymore. Wired into
GroupMembersModal with a per-row "移出" button gated by the same rule
the backend enforces (owner or admin removes a plain member, only the
owner removes an admin, nobody removes the owner or themselves), with
a confirm dialog before the real DELETE call. Verified live end-to-end
against a real owned group: member count 4 -> 3, list updates
correctly (the side panel's own separate "群成员 N" summary count
still trailed behind after this -- confirmed via a direct GET that the
server's own group payload hadn't recalculated member_count yet, a
backend read-consistency lag unrelated to this fix, not chased
further).

Also fixes the reported "已处理的群邀请消息，即使群解散了，接受邀请
按钮还是一直可以点" bug: the button's visibility used to be derived
purely from the notification's static action payload every render, so
neither a successful accept nor a definitively-failed one (expired,
already handled, group gone) ever stopped it from looking freshly
clickable again. Tracks per-invitation resolved state (accepted/
failed) once either outcome happens and swaps the button for a static
resolved label. Doesn't survive a page reload for invitations resolved
in an earlier visit (the notification record itself carries no
resolved flag to read back) -- a real, acknowledged limit, not
silently hidden.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

web/src/lib/api/groups.ts

@@ -186,6 +186,17 @@ export function getAllGroupMembers(
   return fetchAllPages((cursor) => getGroupMembers(topic, { ...opts, cursor }));
 }
 
+/**
+ * `DELETE /groups/{topic}/members/{user_id}` -- confirmed live (2026-09-23) this route now exists
+ * (`server/im_http.go`'s `serveIMGroupMember`, `canRemoveIMGroupMember`): owner or admin can remove a
+ * plain member, only the owner can remove an admin, nobody (owner included) can remove the owner or
+ * themselves. An earlier pass through the protocol doc found no such operation at all -- that was
+ * true then, the backend has since added it, this isn't a doc-vs-reality mismatch this time.
+ */
+export function removeGroupMember(topic: string, userId: string) {
+  return imDelete<{ topic: string; user_id: string; status: string }>(`/groups/${encodeURIComponent(topic)}/members/${encodeURIComponent(userId)}`);
+}
+
 export interface GroupMemberProfile {
   topic: string;
   user_id: string;