fix: bug fixes and UX improvements (v0.3.5)

- Fix clipboard copy error in HTTP environment with execCommand fallback
- Fix team invite page not loading user groups, always showing "join group first"
- Fix JoinGroupPage isMember check using group object instead of user ID
- Fix cancelRSVP deleting all users' RSVP records instead of current user's
- Fix event detail not loading event data itself
- Fix event comment avatar URL missing PocketBase baseUrl prefix
- Fix event creation missing endTime > startTime validation
- Fix event manage/delete permission split (creator+owner vs creator+owner)
- Fix event create button only visible to admins, now all members can create
- Fix event expand not subscribing to comments/RSVP realtime updates
- Fix event relative time not using status field
- Remove duplicate create/join group buttons from header and welcome bar
- Refactor team invite link to use API function

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

frontend/src/api/groups.ts

@@ -190,6 +190,8 @@ export function subscribeGroup(groupId: string, callback: (group: Group) => void
 }
 
 // 转让群主
+// 安全提示：PB groups updateRule 允许认证用户更新，前端校验是唯一防线。
+// 如需服务端强制保护，需添加 PocketBase JS hooks 或改用更严格的 updateRule。
 export async function transferGroupOwnership(groupId: string, newOwnerId: string) {
   const user = pb.authStore.model
   if (!user) throw new Error('未登录')