fix: use private helcimApiToken for all server-side Helcim API calls

server/models/member.js

@@ -45,7 +45,7 @@ const memberSchema = new mongoose.Schema({
   slackInvited: { type: Boolean, default: false },
   slackInviteStatus: {
     type: String,
-    enum: ["pending", "sent", "failed", "accepted"],
+    enum: ["pending", "sent", "failed", "accepted", "joined"],
     default: "pending",
   },
   slackUserId: String,
@@ -133,9 +133,22 @@ const memberSchema = new mongoose.Schema({
     },
   },
 
+  notifications: {
+    events: { type: Boolean, default: true },
+    updates: { type: Boolean, default: true },
+    peerRequests: { type: Boolean, default: true },
+  },
+
   inviteEmailSent: { type: Boolean, default: false },
   inviteEmailSentAt: Date,
 
+  // Magic link single-use enforcement
+  magicLinkJti: String,
+  magicLinkJtiUsed: { type: Boolean, default: false },
+
+  // Session revocation via token versioning
+  tokenVersion: { type: Number, default: 0 },
+
   createdAt: { type: Date, default: Date.now },
   lastLogin: Date,
 });