v2.0.0

Added

• Team mode: invite colleagues with their own master passwords over a shared vault.
  dmage user invite/list/role/rm, dmage auth --invite <token>, dmage whoami.
  Invitations are one-time sealed tokens (the server cannot open them); roles
  (owner/editor/viewer) are enforced server-side. Requires dotmage-server with
  DOTMAGE_MODE=team.
• Offboarding chain: dmage user rm deletes the member's key wraps, revokes their
  devices and offers a key rotation on the spot — the safe path is the default path.

Changed

• Solo setups are untouched: with a solo-mode server (the default) nothing about team
  mode is visible, and existing accounts migrate to a "team of one" automatically.

Security

• A removed member's cached key stops decrypting anything pushed after the chained
  rotation. Rotate the secret values they saw and destroy pre-rotation backups — the
  docs offboarding runbook covers both.