DELETE /v1/rooms: cascade-revoke invites and share link

[sxysun]

Problem

A room was shareable two ways — hmq_… capability tokens (auto-minted at room create) and the hms_… share link — but DELETE /v1/rooms/{id} only flipped revoked_at on the room itself. Every invite and the share link kept resolving at the auth layer; only the run path failed. From the owner's seat in the website this surfaced as "4 live invites" on /app/settings long after the rooms had been revoked, which is the opposite of what revocation should mean.

Change

Make DELETE /v1/rooms/{id} revoke the room and retire every credential pointing at it.

• TenantRegistry.revoke_capabilities_for_room(tenant_id, room_id) -> int — sweeps every live _capability_tokens row whose constraints.room_id matches. Filter is Python-side because constraints is TEXT (JSON-encoded), so we don't introduce a jsonb-only dependency.
• The DELETE handler in api/rooms.py revokes the room first (primary check still wins), then best-effort cascades:
  • revoke_capabilities_for_room for invites
  • disable_room_share_link (already existed) for the share link row
• Cascade failures are logged but do not un-revoke the room. Worst case the owner sees an orphan and can revoke it manually from /app/settings. That's strictly better than leaving the room half-revoked.
• Response shape gains invites_revoked and share_link_disabled so clients (the website, hmctl) can surface what got swept.

Docs

Top-of-file docstring on api/rooms.py now lays out the two sharing primitives in a side-by-side table:

• storage row, mint trigger, who pays, whether bearer needs own tenant key, URL shape, revoke action
  …so the distinction is obvious from the source, not just from product context.

Tests

Three regression tests in tests/test_capability_tokens.py:

• test_revoke_capabilities_for_room_only_targets_matching_room — confirms we sweep only invites for the named room and leave other rooms' invites live.
• test_revoke_capabilities_for_room_idempotent — second call returns 0, doesn't double-revoke.
• test_revoke_capabilities_for_room_unknown_room_returns_zero — guards against accidentally wide queries.

Full capability + room test suite green (70 tests, ~89s):

tests/test_capability_tokens.py    .......................... [37%]
tests/test_room_share_links.py     ..........                 [51%]
tests/test_room_share_links_api.py ...........                [67%]
tests/test_rooms.py                .......................   [100%]
======================== 70 passed in 89.30s ========================

Companion website change

hivemind-website@38ad246 already shipped the explanatory UI on both /app/settings (Room invites panel) and the per-room Share link panel, plus per-row room-name resolution and a "room revoked" pill for orphaned invites that exist today. Once this PR merges, new room revokes will auto-clean and the pill won't appear for fresh ones.

🤖 Generated with Claude Code