First member into a family becomes Admin; subsequent members default to
Member. JWTs carry a family_role claim that is refreshed from the DB on
each request so promotions and demotions take effect immediately.
New /api/family endpoints let admins view the roster, regenerate the
invite code, change roles, and remove members. Last-admin and
self-removal guards prevent locking the family out of management.
The /family page exposes the same actions in the UI; the bottom nav now
links there. Members see the roster but not the invite code.
Existing deployments get a one-time backfill at startup: any family with
members but no admin gets its earliest-joined member promoted.
Josh Rogers