Function add_member 

pub async fn add_member(
    pool: &PgPool,
    actor: &Actor,
    project_id: Uuid,
    username: &str,
    manager: bool,
) -> AppResult<ProjectMember>

Adds a user to a project group (managers and admins); manager makes them a manager as well (an existing member is updated).

Invariants

• Permission: the group is visible to the actor (“not found” otherwise) and the actor manages it (or is an administrator; 403); an unknown username is refused (400).
• Locks: the group row (FOR UPDATE) before the manager check, so a manager removed at the same moment is refused and membership changes of one group are serialised.
• Policy: an administrator who is no member cannot add themselves (or make themselves manager) to a group whose need-to-know policy is in force (403).
• Data: an existing membership keeps its source (an IdP-synchronised one stays one) and is only ever raised to manager here; lowering is demote_manager.
• Audit: project.add_member.
• Notifications / webhooks: none.
• Atomic: one transaction.