add group management menu with metadata, invites, and members

docs/nip29-migration-plan.md

@@ -302,17 +302,19 @@ Validation: same commands; manually delete a message, pin and unpin, leave and r
 
 The remaining moderation surface, all through the calls the backend already exposes.
 
-- **Edit metadata** — a dialog started from `group.metadata().cloned().unwrap_or_default()`:
-  name, about, picture, the flags. `children` is preserved as-is — `edit_metadata` re-emits
-  the full list, and a `9002` that drops one is rejected by the relay.
+- **Edit metadata** — a dialog opened from the panel header's `Manage` menu, started from
+  `group.metadata().cloned().unwrap_or_default()`: name, about, picture, the flags. `children`
+  is preserved as-is — `edit_metadata` re-emits the full list, and a `9002` that drops one is
+  rejected by the relay.
 - **Invite** — `create_invite(code, cx)` with an input or generated code, then
   `metadata.naddr(relay, Some(code))` copied to the clipboard (`naddr` needs parsed metadata;
   a group whose relay publishes no `39000` cannot mint a link).
 - **Users and roles** — add by `npub` → `put_user(pubkey, roles, cx)`, remove →
   `remove_user(pubkey, cx)`; role choices come from `Group::roles()`. The relay is the
   authority for both the roles it supports and who may call these.
-- **React** — the row menu sends `send_reaction(target, emoji, cx)`; a kind `7` row appears
-  inline (that is the current backend behaviour).
+- **React** — a `React` submenu in the same row menu sends `send_reaction(target, emoji, cx)`;
+  a kind `7` row appears inline (that is the current backend behaviour). Unlike the items above
+  it is not admin-only, so the menu now exists for every member.
 
 Validation: same commands; manually exercise each write against a relay that grants the
 account admin, and confirm the refusal path shows the relay's message.
@@ -376,3 +378,7 @@ this repo; `coop_web` check is the proxy.
 - The fork banner's button joins the target group rather than opening it: the panel holds no
   dock handle and the plan's call is `join_key` alone; the joined group then appears in the
   sidebar.
+- The admin writes sit behind a `Manage` menu in the panel header, shown only while the current
+  user is in `Group::admins()`; the details dialog stays read-only. The message row menu is now
+  built for every member — `React` is not moderation — and only its `Pin`/`Delete` items are
+  gated on being an admin.