[api] only send mails to users with email attribute in the groups_users table
[backend] do not project constraints with package constraints for host labels
[api] implement 'creator' as role for (request) events