feat: add dynamic room matchmaking lifecycle

[Ltcc0]

Summary

• create exactly one greedy initial-pair invitation and build the room only after both users accept
• keep active rooms recruiting one queued user at a time until capacity, then stop automatically
• support accept, decline, and semantic stop-match commands across API, agent, memory store, and Supabase
• add transactional service-role-only RPCs, RLS, OpenAPI docs, and end-to-end migration coverage

Verification

• pnpm -r typecheck
• pnpm lint
• pnpm test
• pnpm build
• pnpm agent:migrations:check -- --staged