Invite by team role, not raw capability

Invite sheet

• InviteMemberFields now renders TeamRoleSelect, a searchable role picker backed by FirmRoleView[] from the existing useAppListFirmRoles() query on the Team page.
• The form schema submits teamRoleId, not role. The default is blank, so validation blocks submit until a team role is explicitly selected.
• The pending/member table role columns are untouched; that remains Story 1963 scope.

Clerk contract

• createTeamInvitation() resolves the submitted teamRoleId through firmRolesGateway.list().
• Clerk receives role: toClerkRole(teamRole.capability). The invitation metadata includes both pramaanRole: teamRole.capability for compatibility and teamRoleId: teamRole.id for the Story 1961 backend contract.
• A stale/deleted role id fails before Clerk creation with pramaan.team_invitations.team_role_not_found.

Vocabulary cleanup

• The local invitation schema now exports capabilitySchema / Capability for Clerk access values, freeing "team role" to mean the business designation.
• CapabilitySelect remains in place for Team roles catalog editing, where choosing the access a role grants is still the correct behavior.

Tests and Storybook

• server.test.ts proves selected role id → publicMetadata.teamRoleId and derived Clerk role.
• team-list-page.test.tsx proves the invite sheet blocks submit with no role and sends the selected role UUID in the POST body.
• New TeamRoleSelect stories cover default, selected, disabled, and empty catalog states; invite field/sheet stories now render the role catalog.

Acceptance criteria

• Invite sheet shows a team-role picker. met
• Invite creation writes teamRoleId metadata and derives Clerk role from team-role capability. met
• New copy exists in messages/en.json and messages/hi.json. met
• No pnpm codegen run; committed src/gen stayed untouched. met

Verification

• pnpm lint passed with one pre-existing warning in src/components/add-matter/avatar.tsx.
• pnpm test passed: 155 files, 976 tests.
• pnpm build passed.
• pnpm storybook:build passed.
• git diff --check clean.
• Diff-local hardcoded-copy and color-literal scans found no new violations.

Files changed

17 file(s), +449 / -59 lines