feat(groups): pick members while creating a group

[liqingb0220-stack]

Summary

Creating a group only accepted a name, so members and Agents could only be pulled in after the group already existed. This adds member selection to the create flow itself.

The invite API takes a participant_id, and the only endpoint exposing those ids (GET /{group_id}/member-candidates) requires an existing group — so the create dialog had no way to resolve them. That is why this touches the backend as well as the UI.

Backend

• POST /api/groups accepts an optional member_participant_ids. The group and every initial member are staged in one transaction, so an invalid member rolls the whole thing back rather than leaving an empty group behind.
• New GET /api/groups/member-candidates — tenant-scoped, for use before a group exists. Registered before /{group_id} so the literal path is not parsed as a group id. Excludes the creator, who joins as manager on create.
• Invite validation extracted into _invitable_participant, shared by the create and invite paths, so Agent visibility for the inviter is enforced identically in both.

Fully backward compatible: omitting member_participant_ids reproduces the previous behaviour, and the existing per-group candidates and invite endpoints are unchanged.

Frontend

• New CreateGroupModal replaces the name-only prompt: group name, Agent/member tabs, search, multi-select with a live selection count. Selection survives tab switches; the confirm button is disabled while the request is in flight.
• Styled with the existing group modal tokens; verified in both light and dark themes.

Testing

• pytest -k group — 207 passed, including 4 new cases: create-with-members, rollback on an invalid member, audit details recording the invited ids, and a regression guard that /member-candidates stays registered ahead of /{group_id}.
• ruff check clean on the changed backend files.
• npm run build (tsc strict) passes.
• Manual end-to-end on a local v1.11.1 deployment: one POST creates a 3-member group; an invalid participant_id returns 400 with no group persisted; the UI flow creates the group and navigates into it with all members present.

Checklist

• Tested locally
• No unrelated changes included