A group's owner sees its members and requests, declines and removes

/clientapi/group had no way to see who is in a group or asks to join it,
so a circle's owner could not answer a request from elsewhere. Now:
- GET /clientapi/group/members: the members (local and remote, with their
  role) and the pending requests, for the group's owner and moderators
  only;
- POST /clientapi/group/reject: declines a request, telling the asker's
  server with a Reject of its Follow;
- POST /clientapi/group/remove: takes a member out (never the owner): a
  persona here stops following the group, one elsewhere gets a Reject of
  its Follow, as Mastodon removes a follower.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

docs/ROADMAP.md

@@ -69,6 +69,9 @@ Written 2026-10-01 from the original 2023 code, the decePubClient UI, a federati
     Funkwhale serve it; Funkwhale's answers named after our follow and its deletions of several uploads.
   - GoToSocial's interaction policies both ways; personas join and leave remote events; third-party replies to a
     persona's posts passed on to its followers (owner decisions 2026-10-05).
+  - groups run from the client (2026-10-05): `/clientapi/group/members` shows a group's members and requests to its owner
+    and moderators only, `reject` declines a request and `remove` takes a member out (a `Reject{Follow}` to a member
+    elsewhere); decePubClient's Groups page makes, joins, edits and runs them.
   - wave 2, under way: PieFed, Mbin, NodeBB and Lemmy 0.19 in the pasture with scenarios (2026-10-05). What they showed and was fixed: the
     instance actor answers at the server's root, where PieFed looks for the inbox it announces to; a community's removal
     of a post on its own server is believed at once; a followed group's post its own server sends without announcing