refactor(permissions): add owner check

[ycdzj]

• refactor(namespaces): check if user is owner
• refactor(namespaces): check namespace-owner
• refactor(groups): use namespace owner interceptor
• refactor(invitations): check owner

[Copilot]

Pull Request Overview

This PR refactors permission checks by introducing a reusable @NamespaceOwner decorator that verifies user ownership of namespaces. The refactoring eliminates duplicated authorization logic across controllers by centralizing the ownership validation in an interceptor.

Key changes:

• Created a new NamespaceOwnerInterceptor to validate namespace ownership
• Introduced a @NamespaceOwner decorator for applying the interceptor to controller methods
• Replaced inline ownership checks with the decorator across namespaces, groups, and invitations controllers

Reviewed Changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/namespaces/namespaces.module.ts	Registers the new NamespaceOwnerInterceptor provider
src/namespaces/namespaces.controller.ts	Applies @NamespaceOwner decorator to member and namespace management endpoints
src/namespaces/interceptors/namespace-owner.interceptor.ts	Implements the ownership validation interceptor
src/namespaces/decorators/namespace-owner.decorator.ts	Defines the decorator that applies the interceptor
src/invitations/invitations.module.ts	Imports NamespacesModule to support the ownership decorator
src/invitations/invitations.controller.ts	Applies @NamespaceOwner decorator to invitation management endpoints
src/groups/groups.controller.ts	Removes inline ownership checks and applies @NamespaceOwner decorator to all endpoints

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}