Simplify group lifecycle and add required-update handling (4.0.0)

[seenu-k]

Leaving a settled group could leave an archived, editable local copy that no longer matched the server's access rules. Active membership now controls access throughout the server, local repositories, sync and navigation. Archive and inactivity-based retention are removed; leaving ends access, and the final account holder can leave only when the entire group is settled, permanently deleting it.

• Clear group caches after confirmed departure or access loss, restore membership after a rejected leave, and reject stale group/member writes using their base sequence.
• Start a fresh per-account opensplit-v1-<accountId> local database at Drift schema 1 and a fresh initial Group Durable Object schema. Old local files remain unused. JSON exports remain version 1.
• Centralize the application API under /api/v1. Unsupported unversioned requests cannot reach account or ledger handlers. Future retired numbered versions return 410 / update_required; clients retain readable cached data and pending edits, disable writes, and offer Android in-app updates with a Store fallback or a web service-worker update.
• Refresh screenshots and the feature graphic together, record their source hashes, and have CI reject stale artwork.
• Keep normal CI and deployment on pushes to main; CI also checks artwork freshness. One-off backup, reset and restore tools stay outside the repository.
• Cut 4.0.0 with dart run cider bump major and dart run cider release, following the runbook's rule for releases that leave older clients behind.

Validation

• 590 native Flutter tests, 299 server tests, and 106 tests against the local Cloudflare backend passed during implementation.
• 180 Chrome domain/sync UI tests and 4 Chrome WASM/OPFS/web-update tests passed.
• After the version cut, all 31 release-tooling and JSON export tests passed; screenshots and the feature graphic were regenerated.
• Server lint/type checks, Dart analysis, generated contract/schema checks, formatting and artwork provenance checks passed. After removing temporary maintenance tooling, all 299 server tests and 23 release-tooling tests passed again.

Deployment requirement

This establishes a fresh development storage baseline. Do not deploy the fresh Group migration onto existing objects. Back up and rehearse the retained production data, reset the affected storage with temporary local Wrangler changes, then deploy the product schema and restore/verify that data before merging. Those maintenance tools and temporary deployment changes are not part of this PR.

Merging to main runs the usual CI, deploys the Worker/web bundle, and uploads the matching Android build and artwork to Play. Set PLAY_UPDATE_PRIORITY=4 in the production environment for this breaking release, then restore its ordinary value afterward. The pause covers Play review and installation.

Production data, deployments and Play submissions have not been changed. Actual Play installation and the hosted web update transition remain release acceptance checks.