feat(users): invite by email — a one-time link where the invitee makes their own account (milestone 496)

The operator's ask: an invite link sent by mail, the key in the URL, and
the new user choosing their own username, password and email.

- user_invites (migration 0037): the key's sha256 only, the address, the
  role and days the admin chose, who sent it, used/revoked.
- core/invites: create (revokes an older open invite to the address),
  renew (new key, new clock), find_pending, the four states, signup checks.
- /invite/<key>, outside sign-in and throttled like login: the invitee's
  username, email (prefilled, theirs to change) and password; the account
  takes the admin's role, the key is used up in the same transaction and
  they are signed in. A bad key gets one plain message.
- Settings › Users: Invite by email (address, role, 1/7/30 days), sent from
  the admin in their zone; without a mail server, or if sending fails, the
  link is shown once to copy. Invites not yet used are listed with Resend
  and Withdraw.
- Audit: user.invited, user.invite_resent, user.invite_revoked, user.joined.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/audit/service.py

@@ -128,6 +128,10 @@ ACTIONS = {
     "user.disabled": "disabled user",
     "user.enabled": "enabled user",
     "user.deleted": "deleted user",
+    "user.invited": "invited",
+    "user.invite_resent": "resent the invite to",
+    "user.invite_revoked": "withdrew the invite to",
+    "user.joined": "joined from an invite as",
     "host.created": "added host",
     "host.renamed": "renamed host",
     "host.deleted": "deleted host",