Fix React v2 group participant invitations

[Paul Lizer (paullizer)]

Summary

• Port the source-storage fix from Fix group-scoped conversation invite source storage #1473 to the React branch: group-scoped conversations in regular storage can be shared without losing their history, source links, or existing access restrictions.
• Resolve the People panel's group from the conversation's primary context as well as explicit group metadata. Search current group members rather than unrelated directory users, and show a clear error when the group cannot be identified.
• Preserve the new shared conversation ID for subsequent invitations and cover successful conversion, retained history, visible errors/retries, and personal-chat compatibility through the real React components and isolated Flask handlers.

Target: paullizer-react-v2-ui, not Development. The independent Development/v1 fix has already merged in #1473. This PR carries the separate React follow-up without merging unrelated Development changes.

Linked issue

Refs #1472. Ports the backend fix from #1473; does not reopen or broaden the completed Development/v1 delivery.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• application/single_app/config.py VERSION third segment bumped: 0.261.105 -> 0.261.106 on the React branch.
• deployers/version.txt bump is not needed because deployers/ was not changed.

Testing / validation

The new group-context browser case and six sharing-logic assertions reproduced the frontend failure before its fix.

• node .\functional_tests\test_v2_shared_conversation_logic.mjs — 51 runtime checks passed.
• python -m pytest -q --disable-warnings .\functional_tests\test_group_collaboration_source_storage_fix.py .\functional_tests\test_v2_shared_conversations.py .\functional_tests\test_retention_policy_conversation_scope_coverage.py .\ui_tests\test_v2_group_participant_invites.py — 43 tests and 106 subtests passed.
• python -m pytest -q --disable-warnings .\ui_tests\test_v2_group_participant_invites.py .\functional_tests\test_v2_conversation_details_and_gating.py .\functional_tests\test_docs_app_surface_coverage.py .\functional_tests\test_docs_site_quality.py — 28 tests passed.
• npm run build in application\v2_ui — TypeScript and the local production bundle build succeeded. Vite's large-chunk warning remains non-blocking.
• Repository whitespace checks passed. Browser tests use actual invitation handlers with in-memory storage; no production data or live Azure application services were accessed.

The inherited fix documentation records an unrelated Development-baseline test expecting the old uploaded-image role representation. Neither that model nor that stale test is changed here; the ported regression covers the current image metadata and provenance behavior.

Documentation

• Release notes updated, or not needed — left unchanged; a release-note update was not approved.
• Feature documentation updated: the historical group-invite plan distinguishes the implemented backend/React work from its remaining classic-UI proposals.
• Fix documentation updated: docs/explanation/fixes/GROUP_COLLABORATION_SOURCE_STORAGE_FIX.md includes the separate Development/v1 and React/v2 versions, behavior, and coverage.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security()) — no new routes; existing route security is unchanged.
• Settings sent to non-admin frontends use sanitize_settings_for_user() — no settings-return changes.
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS.
• No secrets, keys, connection strings, or local-only artifacts are included.

Ownership, current group-role/status checks, and group-member-only invitations remain enforced. Storage fallback occurs only on Cosmos not-found, not on authorization or service errors. No data migration, new settings, or deployment changes are included.