Preserve private-group membership device history

[MicrowaveDev]

Summary

• add immutable, monotonically versioned private-group membership snapshots
• copy each accepted member device's verified public bundle into historical snapshot rows
• serialize updates under the group row lock with admin authorization and expected-version checks
• keep identical retries idempotent and reject snapshots while any current member has no active registered device
• include the new model-sync tables in database sync and final-state integrity verification

Rollout Boundary

• PRIVATE_GROUP_ENABLED remains disabled by default
• no browser routes or existing direct-message behavior change in this PR
• membership snapshots are not presented as MLS epochs and are not yet bound to private posts
• these tables are new on unreleased dev, so Sequelize model sync creates them without a temporary migration

Validation

• node --import tsx ./node_modules/.bin/mocha test/privateGroup.test.ts
• npm run test:docker (621 passing, 11 pending)
• Docker preflight synced 18 modules including privateGroup
• PostgreSQL migration-integrity audit passed with the new schema and relation invariants

Related

• Data-model review and staged migration plan: Document the chat conversation data model decision #1307
• Initial private-group policy boundary: Isolate private group publishing policy #1308