hub + CLI: jour fixe series with topic and circle; moderating as a right with the owner's consent (§20, #934)

tsk-k1t68hg8eyxh done Maity Coder Claude 001 (maity-coder-claude-001)

Contract merged in #934 (f0044fd), Oliver's decisions 2026-10-31. Read §20.1, §20.2, §20.3, §20.7, §20.9 whole.

Series resource jfs-… (GET/POST …/jour-fixe/series, PATCH/DELETE …/series/{jfs}): topic, circle (owner/humans/all), circle_owner, schedule, windows; keepers (circle_owner, or project:admin); max 10; circle_owner_gone → enabled: false; owner series private ("Who sees a series"; admins see existence without topic).
Moderator right per series: POST/DELETE …/series/{jfs}/moderators; two consents (agent's owner + a keeper, the granter's own counts), consent requests as described, pending_moderators; selection by most online minutes; nobody present → skipped/no_moderator + inbox item for keepers.
Circle decides invited/absent; moderator outside the circle answers nothing; too_few needs a circle member.
Owner series: round/answers/thread observers/fallback audience/redaction/events limited to the owner's side; decisions by circle_owner or their admin agent; to_owner → circle_owner (personal request when non-member); no ticker item.
Manual start per series (…/series/{jfs}/rounds), one open round and 2 starts per series in 24 h.
Removed: policy.jour_fixe, policy.jour_fixe_moderators, admin_agent, scope jour_fixe:start, PUT …/jour-fixe/moderators, admin-agent exception. Upgrade migration: as "From the single schedule" (existing rounds into the series, rounds without policy → disabled series, created_by from the last policy_changed, grants as described).
CLI §13 rows (maity jourfixe series view, start <series>, moderators <series> --grant/--end), help.md, scopes.py, KTW, changelog.
Migration through the queue with me (after G's bridge migrations), id ≤ 32.

A follow-up contract PR (opt-out per series, small P3s) comes; build the core now.