feat: implement group creation and management (US #28)

Backend:
- Add groups Django app with models: Group, GroupMember, GroupInvite, JoinRequest
- Create serializers with business rule validation
- Implement GroupViewSet with full CRUD + custom actions (members, invites, roles, leave, join requests)
- Add JoinGroupViewSet for invite-based joining flow
- Register app in Django config and URL routing

Frontend:
- Add shared types for groups to @cloud-reader/shared
- Create groups API client (groupsApi)
- Build GroupsListPage, GroupDetailPage (member mgmt, invites, role transfer)
- Build CreateGroupPage and JoinGroupPage
- Add lazy-loaded routes to App.tsx with ProtectedRoute
- Add navigation links to Library header

Ref: #28

backend/apps/groups/permissions.py

@@ -0,0 +1,25 @@
+from rest_framework import permissions
+from rest_framework.request import Request
+
+from apps.groups.models import Group, GroupMember, GroupRole
+
+
+class IsGroupAdmin(permissions.BasePermission):
+    """Only group admins can perform the action."""
+
+    def has_object_permission(self, request: Request, view: object, obj: Group) -> bool:
+        return GroupMember.objects.filter(
+            group=obj,
+            user=request.user,
+            role=GroupRole.ADMIN,
+        ).exists()
+
+
+class IsGroupMember(permissions.BasePermission):
+    """Only group members (any role) can perform the action."""
+
+    def has_object_permission(self, request: Request, view: object, obj: Group) -> bool:
+        return GroupMember.objects.filter(
+            group=obj,
+            user=request.user,
+        ).exists()