fix(core/api): gate group + join-request + conditional-binding mutations

[BK1031]

Stacked on top of #80 — base branch is `bk1031/harden-token-gates`. The diff shown here is just this PR's gates.

Audit holes covered

Two CRITICAL and many HIGH from the post-s2s-auth audit:

• `POST /groups/:id/members` (CRITICAL) — add anyone to Admins
• `POST /groups/:id/owners` (CRITICAL) — make anyone a group owner
• `POST /groups` (UPDATE path), `DELETE /groups/:id`, `DELETE /groups/:id/members/:entityID`, `DELETE /groups/:id/owners/:entityID` (HIGH × 4)
• `POST /groups/:id/requests/:requestID/approve` and `/reject` (HIGH × 2)
• `POST /groups/:id/conditional-bindings` and `DELETE` (HIGH × 2)
• Plus medium-severity: `CreateGroupJoinRequest`, `DeleteGroupJoinRequest`, comment create/delete

Fix shape

One new helper at the api.go level:
```go
func requireGroupOwnerOrAdmin(c, groupID) bool {
Any(
RequestTokenHasScope(c, "sentinel:all"),
RequestUserIsGroupOwner(c, groupID),
RequestUserIsAdmin(c),
)
}
```
Each gated handler calls it at the top; some special cases (join-request self-submission, comment self-authorship) check the bearer's entity directly.

GET endpoints left for PR #83 (PII reads).

Test plan

• Without auth, `POST /groups/:id/members` → 403
• As a non-owner non-admin user, `POST /groups/:id/members` → 403
• As the group's owner, `POST /groups/:id/members` → 200
• As an admin, `POST /groups/:id/members` on any group → 200
• An internal SA's bearer (sentinel:all) → 200
• `CreateGroupJoinRequest` from user A with body `entity_id=B` → 403; with their own → 200
• Comments: delete-your-own works; delete-someone-else's → 403 unless owner/admin