(Business) Phase 4.4: Team Member Management

[psincraian]

Goal

Owners and billing managers can view and manage team members from the portal

Parent Issue: #7905
Depends on: #9007 (Phase 4.1: Member Portal Authentication)

---

Note: Owners and billing managers have identical permissions for team management.

Backend Tasks

1. Add portal endpoints for member management:
   • GET /customer-portal/members - List members of current customer (owner/billing_manager)
   • PATCH /customer-portal/members/{id} - Update role (owner/billing_manager)
   • DELETE /customer-portal/members/{id} - Remove member (owner/billing_manager, cannot remove self)
2. Use CustomerPortalBillingManager auth for these endpoints
3. Add tests for role enforcement (403 for regular members)
4. Backend cleanup: Add validation preventing user from demoting themselves
5. Backend cleanup: Ensure that exactly one owner always exists per customer

Frontend Tasks

1. Add "Team" page to portal navigation (visible to owners/billing_managers only)
2. Display member list with name, email, role, joined date
3. Add role selector dropdown for each member (except self)
4. Add "Remove member" action with confirmation dialog
5. Show warning when changing roles

Key Files

• server/polar/customer_portal/endpoints/member.py (new)
• server/polar/customer_portal/service/member.py (new or extend existing)
• clients/apps/web/src/app/(main)/[organization]/portal/team/ (new)

E2E Test

1. Owner logs in → Sees Team page
2. Billing manager logs in → Sees Team page
3. Regular member logs in → Does NOT see Team page
4. Owner changes a member's role from "member" to "billing_manager" → Success
5. Attempts to remove last owner → Error

Value

Owners/billing managers can manage their team without contacting support

Estimated Effort

• Backend: 1 day
• Frontend: 1.5 days
• Testing: 0.5 days
• Total: 3 days