feat(admin): scope groups to specific GitHub orgs/users

Add an optional owners[] field to groups (super-admin only). When set,
only webhook events whose repository owner or organization login matches
enter that group's routes; empty owners means no restriction, keeping
existing routes backward compatible.

- types: Group.owners?, groups.ts groupAcceptsOwners()
- webhook.ts eventOwners() extracts repo owner + org login
- discord.ts dispatch skips routes whose group rejects the event owner
- admin-routes.ts validateGroups() validates owners list

src/webhook.ts

@@ -131,6 +131,17 @@ function matchFilter(filter: Filter, event: WebhookEvent, keywordBody?: string):
   return filter.exclude ? !matches : matches;
 }
 
+/** Org/user logins that own the event (repository owner + organization). */
+export function eventOwners(event: WebhookEvent): string[] {
+  const owners = new Set<string>();
+  const repoOwner = (event.payload.repository as { owner?: { login?: string } } | undefined)?.owner
+    ?.login;
+  if (repoOwner) owners.add(repoOwner);
+  const org = (event.payload.organization as { login?: string } | undefined)?.login;
+  if (org) owners.add(org);
+  return [...owners];
+}
+
 export function matchRoute(route: Route, event: WebhookEvent): boolean {
   if (!route.enabled) return false;
   const hasKeyword = route.filters.some((f) => f.type === "keyword");