feat(users): invite by email — a one-time link where the invitee makes their own account (milestone 496)

The operator's ask: an invite link sent by mail, the key in the URL, and
the new user choosing their own username, password and email.

- user_invites (migration 0037): the key's sha256 only, the address, the
  role and days the admin chose, who sent it, used/revoked.
- core/invites: create (revokes an older open invite to the address),
  renew (new key, new clock), find_pending, the four states, signup checks.
- /invite/<key>, outside sign-in and throttled like login: the invitee's
  username, email (prefilled, theirs to change) and password; the account
  takes the admin's role, the key is used up in the same transaction and
  they are signed in. A bad key gets one plain message.
- Settings › Users: Invite by email (address, role, 1/7/30 days), sent from
  the admin in their zone; without a mail server, or if sending fails, the
  link is shown once to copy. Invites not yet used are listed with Resend
  and Withdraw.
- Audit: user.invited, user.invite_resent, user.invite_revoked, user.joined.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/templates/settings/users.html

@@ -7,7 +7,9 @@
 {% block section_tabs %}{{ settings_tabs("users") }}{% endblock %}
 {% block breadcrumb %}{{ crumbs([("Settings", "/settings/"), ("Users", "")]) }}{% endblock %}
 {% block content %}
-{% call page_header("Users") %}<a href="/settings/users/new" class="btn">Add user</a>{% endcall %}
+{% call page_header("Users") %}<a href="/settings/users/invite" class="btn">Invite by email</a><a href="/settings/users/new" class="btn btn-ghost">Add user</a>{% endcall %}
+
+{% if done %}<div class="alert alert-success" role="status">{{ done }}</div>{% endif %}
 
 <p class="page-verdict">
   {{ users|length }} account{{ 's' if users|length != 1 }}
@@ -37,5 +39,28 @@
   </tbody>
 </table>
 </div>
+{% if invites %}
+<div class="card-flush">
+<table class="table">
+  <caption class="table-caption">Invites not yet used</caption>
+  <thead><tr><th>Sent to</th><th>Role</th><th>Sent by</th><th>Link works until</th><th class="num">Actions</th></tr></thead>
+  <tbody>
+  {% for i, state, by in invites %}
+  <tr>
+    <td>{{ i.email }}</td>
+    <td>{{ i.role.value|capitalize }}</td>
+    <td>{{ by }}</td>
+    <td class="nowrap">{% if state == "expired" %}{{ status_badge("inactive", "Expired") }}{% else %}{{ i.expires_at|when }}{% endif %}</td>
+    <td class="num nowrap">
+      <form method="post" action="/settings/users/invites/{{ i.id }}/resend" class="inline-form">{{ csrf_field() }}<button type="submit" class="btn btn-ghost btn-sm">Resend</button></form>
+      <form method="post" action="/settings/users/invites/{{ i.id }}/revoke" class="inline-form"
+            data-confirm="Withdraw the invite to {{ i.email }}? Its link stops working.">{{ csrf_field() }}<button type="submit" class="btn btn-ghost btn-sm">Withdraw</button></form>
+    </td>
+  </tr>
+  {% endfor %}
+  </tbody>
+</table>
+</div>
+{% endif %}
 <p class="field-hint">Accounts that sign in with LDAP or single sign-on are added at their first sign-in, with the role their provider's groups give them (Settings › <a href="/settings/auth/">Authentication</a>).</p>
 {% endblock %}