feat: member portal Sprint 7 — Circles (interest/affinity sub-groups)

- Circle + CircleMembership models + migration (CircleRole: MEMBER/LEAD, public/invite-only)
- CirclesModule: admin CRUD + member list; unique circle name per tenant
- Member endpoints in MyController: GET /my/circles, POST /my/circles/:id/join|leave
- listForMember returns public circles + private ones the member belongs to, with isMember/myRole/memberCount
- join() enforces invite-only; leave() removes membership
- /my/circles page: "My circles" + "Discover" split, join/leave button, LEAD + Private badges
- Member + admin BFF routes; Circles nav item
- Register CirclesModule; add CIRCLE_CREATED/DELETED audit actions

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/web/app/api/admin/circles/[id]/members/route.ts

@@ -0,0 +1,13 @@
+import { apiFetch, jsonResponse } from '../../../../../_lib/api';
+
+export const dynamic = 'force-dynamic';
+
+export async function GET(
+  _request: Request,
+  { params }: { params: Promise<{ id: string }> },
+): Promise<Response> {
+  const { id } = await params;
+  const res = await apiFetch(`/admin/circles/${id}/members`);
+  const body = await res.json();
+  return jsonResponse(body, res.status);
+}

apps/web/app/api/admin/circles/[id]/route.ts

@@ -0,0 +1,28 @@
+import { apiFetch, jsonResponse } from '../../../../_lib/api';
+
+export const dynamic = 'force-dynamic';
+
+export async function PATCH(
+  request: Request,
+  { params }: { params: Promise<{ id: string }> },
+): Promise<Response> {
+  const { id } = await params;
+  const body = await request.json();
+  const res = await apiFetch(`/admin/circles/${id}`, {
+    method: 'PATCH',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify(body),
+  });
+  const resBody = await res.json();
+  return jsonResponse(resBody, res.status);
+}
+
+export async function DELETE(
+  _request: Request,
+  { params }: { params: Promise<{ id: string }> },
+): Promise<Response> {
+  const { id } = await params;
+  const res = await apiFetch(`/admin/circles/${id}`, { method: 'DELETE' });
+  const resBody = await res.json();
+  return jsonResponse(resBody, res.status);
+}