feat: member portal Sprint 7 — Circles (interest/affinity sub-groups)

- Circle + CircleMembership models + migration (CircleRole: MEMBER/LEAD, public/invite-only)
- CirclesModule: admin CRUD + member list; unique circle name per tenant
- Member endpoints in MyController: GET /my/circles, POST /my/circles/:id/join|leave
- listForMember returns public circles + private ones the member belongs to, with isMember/myRole/memberCount
- join() enforces invite-only; leave() removes membership
- /my/circles page: "My circles" + "Discover" split, join/leave button, LEAD + Private badges
- Member + admin BFF routes; Circles nav item
- Register CirclesModule; add CIRCLE_CREATED/DELETED audit actions

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/api/src/modules/my/my.controller.ts

@@ -1,6 +1,7 @@
 import { Body, Controller, Delete, Get, Param, Patch, Post } from '@nestjs/common';
 import { MyService } from './my.service';
 import { SevaService } from '../seva/seva.service';
+import { CirclesService } from '../circles/circles.service';
 import { MemberAuth } from '../auth/member-auth.decorator';
 import { CurrentMember } from '../auth/current-member.decorator';
 import type { MemberJwtPayload } from '@tower/types';
@@ -26,6 +27,7 @@ export class MyController {
   constructor(
     private readonly service: MyService,
     private readonly seva: SevaService,
+    private readonly circles: CirclesService,
   ) {}
 
   @Get('seva')
@@ -43,6 +45,21 @@ export class MyController {
     return this.seva.cancel(member.sub, member.tenantId, id);
   }
 
+  @Get('circles')
+  circlesList(@CurrentMember() member: MemberJwtPayload) {
+    return this.circles.listForMember(member.sub, member.tenantId);
+  }
+
+  @Post('circles/:id/join')
+  circleJoin(@CurrentMember() member: MemberJwtPayload, @Param('id') id: string) {
+    return this.circles.join(member.sub, member.tenantId, id);
+  }
+
+  @Post('circles/:id/leave')
+  circleLeave(@CurrentMember() member: MemberJwtPayload, @Param('id') id: string) {
+    return this.circles.leave(member.sub, member.tenantId, id);
+  }
+
   @Get('dashboard')
   dashboard(@CurrentMember() member: MemberJwtPayload) {
     return this.service.getDashboard(member.sub, member.tenantId);