Team leads can add any user except the core admin; allow email usernames

[snevesbarros]

Summary

Fixes two problems with adding team members, found after the type-ahead shipped.

• Email usernames: the member search (q) and POST /team/:id/members only accepted [A-Za-z0-9-_], so SSO accounts whose username is an email address could not be found or added. Both now accept . _ @ + - (search 3-254 chars, username 2-254). The search term is regex-escaped so . and + match literally.
• Missing users: the search, add and remove all restricted team leads to users with the user role, so local team leads and admins never appeared. That restriction is removed: a team lead can add and remove any user, whatever their role or sign-in method.
• Core admin: the seeded account (ANGLES_ADMIN_USERNAME, default admin, new helper getCoreAdminUsername) is never returned by the search, a team lead cannot add or remove it, and the member list flags it with isCoreAdmin so a client can show it as locked. Admins can still add it. Team leads still cannot remove themselves.

Consequences to be aware of

• A team lead can now add another team lead or admin to their team, and an added team lead gets lead powers on that team. This was an explicit product decision.
• Removal was widened to match, so a lead can undo what they add. Say if removal should stay stricter.

Swagger updated.

Testing

test/team-members.tests.js updated and extended (45 tests): leads see and can add other leads, admins and SSO users; the core admin is never offered and a lead cannot add or remove it; email-style usernames are found and added, with . and + matched literally; the isCoreAdmin flag. The suite points ANGLES_ADMIN_USERNAME at a test account, so it does not depend on an admin user existing. Full suite: 680 passing.

Companion PRs: AnglesHQ/angles-ui, AnglesHQ/angles-javascript-client, AnglesHQ/angleshq.github.io.

🤖 Generated with Claude Code

https://claude.ai/code/session_0121r5gnmvth6hy4tPpNT8sM

---

Generated by Claude Code