feat(users): invite by email — a one-time link where the invitee makes their own account (milestone 496)

The operator's ask: an invite link sent by mail, the key in the URL, and
the new user choosing their own username, password and email.

- user_invites (migration 0037): the key's sha256 only, the address, the
  role and days the admin chose, who sent it, used/revoked.
- core/invites: create (revokes an older open invite to the address),
  renew (new key, new clock), find_pending, the four states, signup checks.
- /invite/<key>, outside sign-in and throttled like login: the invitee's
  username, email (prefilled, theirs to change) and password; the account
  takes the admin's role, the key is used up in the same transaction and
  they are signed in. A bad key gets one plain message.
- Settings › Users: Invite by email (address, role, 1/7/30 days), sent from
  the admin in their zone; without a mail server, or if sending fails, the
  link is shown once to copy. Invites not yet used are listed with Resend
  and Withdraw.
- Audit: user.invited, user.invite_resent, user.invite_revoked, user.joined.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/templates/email/invite.html

@@ -0,0 +1,19 @@
+{# An invite email's HTML part (milestone 496): i = the facts mail.invite_email builds. #}
+{% extends "_layout.html" %}
+{% from "_parts.html" import button, fact with context %}
+{% block title %}{{ i.inviter }} invited you to Steward{% endblock %}
+{% block body %}
+<tr><td style="padding:10px 24px 4px 24px;font:600 20px/1.35 {{ c.font }};color:{{ c.text }};">{{ i.inviter }} invited you to Steward.</td></tr>
+<tr><td style="padding:6px 24px 4px 24px;font:14px/1.55 {{ c.font }};color:{{ c.text }};">Open the link to make your account: you choose your username, email and password.</td></tr>
+<tr><td style="padding:10px 24px 4px 24px;">
+<table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0">
+{{ fact("You'll be", i.role) }}
+{% call fact("Link works until") %}{{ i.expires }}{% if i.expires_utc %}<br><span style="color:{{ c.muted }};">{{ i.expires_utc }}</span>{% endif %}{% endcall %}
+</table>
+</td></tr>
+<tr><td style="padding:16px 24px 8px 24px;">{{ button(i.link, "Make your account") }}</td></tr>
+<tr><td style="padding:4px 24px 20px 24px;font:12px/1.5 {{ c.font }};color:{{ c.muted }};word-break:break-all;">Or paste this into your browser: {{ i.link }}</td></tr>
+{% endblock %}
+{% block footer %}
+The link works once. If you weren't expecting this, ignore it and nothing happens.
+{% endblock %}

steward/templates/email/invite.txt

@@ -0,0 +1,14 @@
+{# An invite email's plain-text part; the same facts as invite.html. #}
+{{ i.inviter }} invited you to Steward.
+
+Open the link to make your account: you choose your username, email and
+password.
+
+You'll be {{ i.role }}.
+Link works until: {{ i.expires }}{% if i.expires_utc %} ({{ i.expires_utc }}){% endif %}
+
+Make your account: {{ i.link }}
+
+--
+The link works once. If you weren't expecting this, ignore it and nothing
+happens.