feat(admin): scope groups to specific GitHub orgs/users

Add an optional owners[] field to groups (super-admin only). When set,
only webhook events whose repository owner or organization login matches
enter that group's routes; empty owners means no restriction, keeping
existing routes backward compatible.

- types: Group.owners?, groups.ts groupAcceptsOwners()
- webhook.ts eventOwners() extracts repo owner + org login
- discord.ts dispatch skips routes whose group rejects the event owner
- admin-routes.ts validateGroups() validates owners list

src/types.ts

@@ -53,6 +53,12 @@ export interface Group {
    * Super admins (ADMIN_USER_IDS) always have access regardless of this list.
    */
   adminIds: string[];
+  /**
+   * GitHub organization/user logins (case-insensitive) whose webhook events are
+   * allowed into this group's routes. Empty/omitted = no owner restriction.
+   * Only super admins may edit this field.
+   */
+  owners?: string[];
 }
 
 export interface Filter {