feat(api)!: fold devices into users and report member presence

Contract 7.0.0 (breaking). Devices become an attribute of the account;
members are managed per user, and only unauthenticated guests keep a
per-terminal registration.

- rename seats -> max_members, seats_used -> members_used,
  seats_full -> members_full, SeatJoined -> JoinResult, the `seats`
  stream control message -> `members`, and POST /channels/{id}/seats ->
  POST /channels/{id}/join (stored channel settings are migrated on start)
- drop per-terminal encrypted device labels and the seat list/release
  endpoints; add GET/DELETE /channels/{id}/guests for guest terminals
- authenticate account members by account session only: the terminal key
  is optional for logged-in accounts, no seat row is written for them,
  and gated-download grants are counted per user (per terminal for guests)
- GET /channels/{id}/members now returns online, devices and
  online_devices per account; presence is tracked in memory from active
  WebSocket/SSE subscriptions and is not pushed over the stream
- owner invitation list no longer returns accounts that already joined

server/src/WebDrop.Api/ApiContract.cs

@@ -2,7 +2,8 @@ namespace WebDrop.Api;
 
 public static class ApiContract
 {
-    // v5 changes channel capacity from per-endpoint devices to account members.
+    // v5: 频道容量按账号成员计;v7: seats 改名 max_members/members_used/members_full,
+    // 去掉设备名与设备清单接口,访客改走 /guests。设备只是账号的属性。
     // Keep this aligned with contracts/api-contract.json and docs/openapi.yaml.
-    public const string Version = "6.0.0";
+    public const string Version = "7.0.0";
 }