fix(core): enforce join request integrity

[BK1031]

• Scope join requests and comments to their parent group and request IDs
• Derive reviewer and comment actors from authenticated token claims
• Restrict internal bypasses to service-account tokens instead of all first-party sessions
• Atomically lock, review, and create memberships for pending requests
• Allow requesters to cancel their own pending requests and clean up comments transactionally
• Add authorization and transactional regression coverage