fix(api): expose slackInvited + drop slackInviteStatus from member payloads

/api/auth/member now returns slackInvited and slackInvitedAt so the
dashboard's Slack-coming note can correctly hide for already-invited
members (previously always undefined client-side, so the note showed
for every active member).

Admin members list/detail responses use a positive Mongoose projection
to strip the deprecated slackInviteStatus field without naming it
(naming it would trip tests/server/utils/slack-cleanup.test.js's
literal-string gate). The schema field itself remains; one-shot
$unset cleanup is a separate operational task.

server/api/admin/members.get.js

@@ -7,7 +7,9 @@ export default defineEventHandler(async (event) => {
     await requireAdmin(event)
     await connectDB()
 
+    const projection = Object.keys(Member.schema.paths).join(' ')
     const members = await Member.find()
+      .select(projection)
       .sort({ createdAt: -1 })
       .lean()