feat(users): invite by email — a one-time link where the invitee makes their own account (milestone 496)

The operator's ask: an invite link sent by mail, the key in the URL, and
the new user choosing their own username, password and email.

- user_invites (migration 0037): the key's sha256 only, the address, the
  role and days the admin chose, who sent it, used/revoked.
- core/invites: create (revokes an older open invite to the address),
  renew (new key, new clock), find_pending, the four states, signup checks.
- /invite/<key>, outside sign-in and throttled like login: the invitee's
  username, email (prefilled, theirs to change) and password; the account
  takes the admin's role, the key is used up in the same transaction and
  they are signed in. A bad key gets one plain message.
- Settings › Users: Invite by email (address, role, 1/7/30 days), sent from
  the admin in their zone; without a mail server, or if sending fails, the
  link is shown once to copy. Invites not yet used are listed with Resend
  and Withdraw.
- Audit: user.invited, user.invite_resent, user.invite_revoked, user.joined.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/templates/auth/invite.html

@@ -0,0 +1,43 @@
+{# auth/invite.html — where an invitee makes their own account (milestone 496).
+   `invite` is the working invite, or none: then only `error` shows. #}
+{% extends "base.html" %}
+{% block title %}Join Steward{% endblock %}
+{% block content %}
+<div class="invite-page">
+  <div class="card">
+    <h1 class="invite-title">Join Steward</h1>
+    {% if invite %}
+    <p class="invite-lede">{{ inviter }} invited you as {{ "an" if invite.role.value in ("admin", "operator") else "a" }} {{ invite.role.value }}. Choose your username, email and password.</p>
+    {% if session.user_id %}<p class="field-hint">You're signed in as {{ session.username }}. Making this account signs you in as it instead.</p>{% endif %}
+    {% endif %}
+    {% if error %}<div class="alert alert-error" role="alert">{{ error }}</div>{% endif %}
+    {% if invite %}
+    <form method="post" action="/invite/{{ key }}">{{ csrf_field() }}
+      <div class="field">
+        <label class="field-label" for="inv-username">Username</label>
+        <input class="input" id="inv-username" type="text" name="username" maxlength="64" required autofocus
+               autocomplete="username" value="{{ form.get('username', '') }}">
+      </div>
+      <div class="field">
+        <label class="field-label" for="inv-email">Email</label>
+        <input class="input" id="inv-email" type="email" name="email" maxlength="255" required
+               autocomplete="email" value="{{ form.get('email', '') }}">
+        <span class="field-hint">Steward sends alerts and the weekly report here; you can turn them off later.</span>
+      </div>
+      <div class="field">
+        <label class="field-label" for="inv-pw">Password</label>
+        <input class="input" id="inv-pw" type="password" name="password" minlength="{{ min_password }}" required autocomplete="new-password">
+        <span class="field-hint">At least {{ min_password }} characters.</span>
+      </div>
+      <div class="field">
+        <label class="field-label" for="inv-pw2">Password again</label>
+        <input class="input" id="inv-pw2" type="password" name="confirm" required autocomplete="new-password">
+      </div>
+      <button type="submit" class="btn invite-submit">Make my account</button>
+    </form>
+    {% else %}
+    <a href="/login" class="btn btn-ghost">Go to sign in</a>
+    {% endif %}
+  </div>
+</div>
+{% endblock %}

steward/templates/email/invite.html

@@ -0,0 +1,19 @@
+{# An invite email's HTML part (milestone 496): i = the facts mail.invite_email builds. #}
+{% extends "_layout.html" %}
+{% from "_parts.html" import button, fact with context %}
+{% block title %}{{ i.inviter }} invited you to Steward{% endblock %}
+{% block body %}
+<tr><td style="padding:10px 24px 4px 24px;font:600 20px/1.35 {{ c.font }};color:{{ c.text }};">{{ i.inviter }} invited you to Steward.</td></tr>
+<tr><td style="padding:6px 24px 4px 24px;font:14px/1.55 {{ c.font }};color:{{ c.text }};">Open the link to make your account: you choose your username, email and password.</td></tr>
+<tr><td style="padding:10px 24px 4px 24px;">
+<table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0">
+{{ fact("You'll be", i.role) }}
+{% call fact("Link works until") %}{{ i.expires }}{% if i.expires_utc %}<br><span style="color:{{ c.muted }};">{{ i.expires_utc }}</span>{% endif %}{% endcall %}
+</table>
+</td></tr>
+<tr><td style="padding:16px 24px 8px 24px;">{{ button(i.link, "Make your account") }}</td></tr>
+<tr><td style="padding:4px 24px 20px 24px;font:12px/1.5 {{ c.font }};color:{{ c.muted }};word-break:break-all;">Or paste this into your browser: {{ i.link }}</td></tr>
+{% endblock %}
+{% block footer %}
+The link works once. If you weren't expecting this, ignore it and nothing happens.
+{% endblock %}

steward/templates/email/invite.txt

@@ -0,0 +1,14 @@
+{# An invite email's plain-text part; the same facts as invite.html. #}
+{{ i.inviter }} invited you to Steward.
+
+Open the link to make your account: you choose your username, email and
+password.
+
+You'll be {{ i.role }}.
+Link works until: {{ i.expires }}{% if i.expires_utc %} ({{ i.expires_utc }}){% endif %}
+
+Make your account: {{ i.link }}
+
+--
+The link works once. If you weren't expecting this, ignore it and nothing
+happens.

steward/templates/settings/user_invite.html

@@ -0,0 +1,43 @@
+{# settings/user_invite.html — invite someone by email (milestone 496): they
+   make their own account from the link, with the role chosen here. #}
+{% extends "base.html" %}
+{% from "_macros.html" import crumbs, page_header %}
+{% from "settings/_tabs.html" import settings_tabs %}
+{% block title %}Invite by email — Settings — Steward{% endblock %}
+{% block section_tabs %}{{ settings_tabs("users") }}{% endblock %}
+{% block breadcrumb %}{{ crumbs([("Settings", "/settings/"), ("Users", "/settings/users/"), ("Invite by email", "")]) }}{% endblock %}
+{% block content %}
+{{ page_header("Invite by email", "They choose their own username, email and password from the link.") }}
+{% if error %}<div class="alert alert-error" role="alert">{{ error }}</div>{% endif %}
+
+<form method="post" action="/settings/users/invite" class="form-page">{{ csrf_field() }}
+  <section class="card form-section" aria-labelledby="inv-who">
+    <h2 id="inv-who" class="section-title">Invite</h2>
+    <div class="field">
+      <label class="field-label" for="inv-email">Send to</label>
+      <input class="input" id="inv-email" type="email" name="email" maxlength="255" required autofocus
+             value="{{ form.get('email', '') }}" autocomplete="off">
+      {% if not mail_ready %}<span class="field-hint tone-warn">No mail server is set, so you'll get the link to pass on yourself. Set one in Settings › <a href="/settings/notifications/">Notifications</a>.</span>{% endif %}
+    </div>
+    <div class="form-pair">
+      <div class="field">
+        <label class="field-label" for="inv-role">Role</label>
+        <select class="input" id="inv-role" name="role">
+          {% for r in roles %}<option value="{{ r.value }}" {% if form.get('role', 'viewer') == r.value %}selected{% endif %}>{{ r.value|capitalize }}</option>{% endfor %}
+        </select>
+      </div>
+      <div class="field">
+        <label class="field-label" for="inv-days">Link works for</label>
+        <select class="input" id="inv-days" name="days">
+          {% for d in days %}<option value="{{ d }}" {% if form.get('days', default_days|string) == d|string %}selected{% endif %}>{{ d }} day{{ 's' if d != 1 }}</option>{% endfor %}
+        </select>
+      </div>
+    </div>
+    <p class="field-hint">A viewer reads; an operator also runs playbooks and changes monitors, hosts and alerts; an admin also changes Settings and users. They can't change the role you pick. The link works once.</p>
+  </section>
+  <div class="form-actions">
+    <button type="submit" class="btn">{{ "Send invite" if mail_ready else "Make invite link" }}</button>
+    <a href="/settings/users/" class="btn btn-ghost">Cancel</a>
+  </div>
+</form>
+{% endblock %}

steward/templates/settings/user_invite_link.html

@@ -0,0 +1,24 @@
+{# settings/user_invite_link.html — an invite's link, shown once (milestone
+   496), when mail didn't carry it: no mail server, or sending failed. #}
+{% extends "base.html" %}
+{% from "_macros.html" import crumbs, page_header %}
+{% from "settings/_tabs.html" import settings_tabs %}
+{% block title %}Invite link — Settings — Steward{% endblock %}
+{% block section_tabs %}{{ settings_tabs("users") }}{% endblock %}
+{% block breadcrumb %}{{ crumbs([("Settings", "/settings/"), ("Users", "/settings/users/"), ("Invite link", "")]) }}{% endblock %}
+{% block content %}
+{{ page_header("Invite link for " ~ invite.email) }}
+<div class="form-page">
+  <p class="page-verdict" role="status">{{ why }}</p>
+  <section class="card form-section" aria-labelledby="link-title">
+    <h2 id="link-title" class="section-title">Copy this link now. It can't be shown again.</h2>
+    <div class="copy-once">
+      <input class="input" type="text" id="invite-url" value="{{ url }}" readonly aria-label="Invite link">
+      <button type="button" class="btn btn-ghost btn-sm"
+              onclick="navigator.clipboard.writeText(document.getElementById('invite-url').value).then(()=>this.textContent='Copied')">Copy</button>
+    </div>
+    <p class="field-hint">Send it to {{ invite.email }} yourself. It makes one {{ invite.role.value }} account and works until {{ invite.expires_at|when }}. If you lose it, resend the invite from Users for a new link.</p>
+  </section>
+  <div class="form-actions"><a href="/settings/users/" class="btn">Back to Users</a></div>
+</div>
+{% endblock %}

steward/templates/settings/users.html

@@ -7,7 +7,9 @@
 {% block section_tabs %}{{ settings_tabs("users") }}{% endblock %}
 {% block breadcrumb %}{{ crumbs([("Settings", "/settings/"), ("Users", "")]) }}{% endblock %}
 {% block content %}
-{% call page_header("Users") %}<a href="/settings/users/new" class="btn">Add user</a>{% endcall %}
+{% call page_header("Users") %}<a href="/settings/users/invite" class="btn">Invite by email</a><a href="/settings/users/new" class="btn btn-ghost">Add user</a>{% endcall %}
+
+{% if done %}<div class="alert alert-success" role="status">{{ done }}</div>{% endif %}
 
 <p class="page-verdict">
   {{ users|length }} account{{ 's' if users|length != 1 }}
@@ -37,5 +39,28 @@
   </tbody>
 </table>
 </div>
+{% if invites %}
+<div class="card-flush">
+<table class="table">
+  <caption class="table-caption">Invites not yet used</caption>
+  <thead><tr><th>Sent to</th><th>Role</th><th>Sent by</th><th>Link works until</th><th class="num">Actions</th></tr></thead>
+  <tbody>
+  {% for i, state, by in invites %}
+  <tr>
+    <td>{{ i.email }}</td>
+    <td>{{ i.role.value|capitalize }}</td>
+    <td>{{ by }}</td>
+    <td class="nowrap">{% if state == "expired" %}{{ status_badge("inactive", "Expired") }}{% else %}{{ i.expires_at|when }}{% endif %}</td>
+    <td class="num nowrap">
+      <form method="post" action="/settings/users/invites/{{ i.id }}/resend" class="inline-form">{{ csrf_field() }}<button type="submit" class="btn btn-ghost btn-sm">Resend</button></form>
+      <form method="post" action="/settings/users/invites/{{ i.id }}/revoke" class="inline-form"
+            data-confirm="Withdraw the invite to {{ i.email }}? Its link stops working.">{{ csrf_field() }}<button type="submit" class="btn btn-ghost btn-sm">Withdraw</button></form>
+    </td>
+  </tr>
+  {% endfor %}
+  </tbody>
+</table>
+</div>
+{% endif %}
 <p class="field-hint">Accounts that sign in with LDAP or single sign-on are added at their first sign-in, with the role their provider's groups give them (Settings › <a href="/settings/auth/">Authentication</a>).</p>
 {% endblock %}