Fix group-scoped conversation invite source storage

[Paul Lizer (paullizer)]

Summary

• Fix the first group-participant invitation returning 404 Conversation not found when a group-scoped conversation is physically stored in conversations/messages.
• Preserve legacy group-store precedence and fall back only on a genuine not-found. Keep the source container, existing message copier, source links, hiding, and final cache invalidation consistent with the actual storage layout.
• Preserve ownership, current group membership/status, and group-member-only invitation restrictions. Existing AI-source reuse, masking, deletion, retention, repeated invitations, and personal conversion behavior remain compatible.
• Development/v1 only, targeting Development. No React/v2 implementation or parity claim, UI changes, new routes/settings, data migration, or deployment changes. Application version: 0.261.024.

Linked issue

Fixes #1472

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Release notes are unchanged and are being handled separately through the existing user checkpoint.

Version bump

• application/single_app/config.py VERSION third segment bumped: 0.261.023 -> 0.261.024
• deployers/version.txt bump not needed because deployers/ was not changed

Testing / validation

• Before the production fix, the new isolated regression reproduced the exact 404 through the existing v1 Flask handler.
• python .\functional_tests\test_group_collaboration_source_storage_fix.py — 18 tests passed standalone, without application startup or Azure services. Under pytest, the new suite also exercises 106 passing subtests.
• Combined focused pytest run covering conversion, group participants, legacy messages, image-proposal porting, invitation access, shared AI, retention, all three route-policy suites, and both documentation suites: 60 passed, 106 subtests passed, 1 pre-existing failure.
• git -c core.whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol diff --check — clean.

Known baseline limitation: test_collaboration_legacy_message_conversion.py::test_uploaded_image_conversion_preserves_user_sender already fails on Development because it expects role user, while the existing model preserves role image. This was reproduced before the production edits. The model and that test are unchanged; the new regressions cover preservation of the current uploaded-image sender metadata, provenance, and associations. The combined run is not claimed to be fully passing.

The new behavioral coverage uses actual production helpers and partition-aware in-memory stores for both layouts, all allowed group roles/statuses, history/citation preservation, no-mutation rejection paths, lookup precedence and service failures, API responses/events, repeated invites after source synchronization, AI backing-source reuse, masking, and manual/retention/archive cleanup with unrelated-record guards.

Documentation

• Release notes updated, or not needed — separate user checkpoint; unchanged in this PR
• Feature documentation updated, or not needed — historical invitation plan now distinguishes this implemented backend fix from its broader UI proposals
• Fix documentation updated: docs/explanation/fixes/GROUP_COLLABORATION_SOURCE_STORAGE_FIX.md

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security()) — no routes added or changed
• Settings sent to non-admin frontends use sanitize_settings_for_user() — no settings/frontend changes
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS — no browser asset changes
• No secrets, keys, connection strings, or local-only artifacts are included