feat(admin): scope groups to specific GitHub orgs/users

Add an optional owners[] field to groups (super-admin only). When set,
only webhook events whose repository owner or organization login matches
enter that group's routes; empty owners means no restriction, keeping
existing routes backward compatible.

- types: Group.owners?, groups.ts groupAcceptsOwners()
- webhook.ts eventOwners() extracts repo owner + org login
- discord.ts dispatch skips routes whose group rejects the event owner
- admin-routes.ts validateGroups() validates owners list

src/admin-routes.ts

@@ -106,6 +106,13 @@ function validateGroups(
     ) {
       return { ok: false, error: `group "${g.id}".adminIds must be a list of strings` };
     }
+    if (
+      g.owners !== undefined &&
+      (!Array.isArray(g.owners) ||
+        !g.owners.every((o) => typeof o === "string" && o.trim().length > 0))
+    ) {
+      return { ok: false, error: `group "${g.id}".owners must be a list of strings` };
+    }
   }
   return { ok: true, groups: groups as Group[] };
 }