feat: merge an existing friend during invite claim

[AnganSamadder]

Summary

• let an invite claimant select an existing unlinked friend and atomically merge that identity into the claimed account
• add the iOS selection sheet, pending-state locking, cancellation-safe validation, and canonical post-claim refresh
• add owner-scoped local aliases and bounded rewrites for the caller's groups and expenses
• preserve friend metadata, participant visibility, and retry idempotency across interrupted claims
• document the merge contract and add backend/iOS regression coverage

Security and correctness

• the invite target is derived server-side from the token creator
• local aliases are owner-scoped and never become global identity aliases
• merge candidates must be owned, unlinked, non-ghost identities
• group and expense rewrites use indexed, caller-bounded queries
• a claimed token is bound to the original merge selection, preventing a retry from changing identities
• recreated or nested source rows are absorbed without leaving duplicate friends
• stale source visibility is removed while unrelated participant visibility is retained

Stack

This PR intentionally targets fix/e2e-remediation so the merge-friend review contains only feature-specific changes. After the bug-fix PR merges, retarget this PR to main.

Validation

• FAIL_ON_WARNINGS=1 ./scripts/test-ci-locally.sh
  • backend: 69/69
  • iOS: 2,585/2,585
  • web smoke: passed
  • overall coverage: 60.18% (CI threshold: 48%)
  • warnings: 0
• SANITIZER=thread FAIL_ON_WARNINGS=1 ./scripts/test-ci-locally.sh
  • iOS: 2,585/2,585
  • Thread Sanitizer findings: 0
• SANITIZER=address FAIL_ON_WARNINGS=1 ./scripts/test-ci-locally.sh
  • iOS: 2,585/2,585
  • Address Sanitizer findings: 0

Review

Independent backend/security, iOS/lifecycle, and PR-architecture reviews were completed. Findings around owner scoping, token retry binding, visibility reconciliation, UI cancellation, pending-flow locking, and canonical final-state verification were resolved.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
payback	Ready	Preview	Jul 31, 2026 3:04am