invites: an admin lets one person register while registration stays closed

Until now adding a second person meant re-opening registration to the
whole internet while they signed up (#2939 §1). An admin now makes an
invite in Settings: a link that works once, expires (7 days by default,
1 to 30), and can be pinned to one email address. Only the token's hash
is stored, so the link is shown once.

POST /api/auth/register takes `invite`. Redemption is one conditional
UPDATE inside the transaction that creates the account, so two people
racing one link can't both get in, and a taken email leaves the invite
unused. Every refusal says "invalid or expired invite". The register
page reads ?invite= and opens even while registration is closed.

Refs #5172

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/public-hosting.md

@@ -20,8 +20,9 @@ first account is created, so a server whose admin already existed keeps whatever
 Access → Allow new registrations** before exposing an instance you have been running
 on a LAN.
 
-To let someone else in, turn it back on, have them register, turn it off. There is no
-invite system yet, so that is the mechanism.
+To let someone else in, send them an invite: **Settings → Invites** makes a link that
+works once, expires (a week by default), and can be pinned to one email address. It
+lets that one person register while registration stays closed.
 
 **2. Terminate TLS in front of it, and forward the scheme.** The app marks the
 session cookie `Secure` and sends HSTS only when it can tell the request arrived over
@@ -121,9 +122,6 @@ Know these before you decide who gets an account.
   with `docker compose logs app`, which is enough to see whether anyone is knocking.
   They are not queryable, not retained beyond the container's log rotation, and not
   attributable after the fact.
-- **No invites.** Adding a second person means re-opening registration while they
-  sign up, then closing it again. There is no per-person token, no expiry, and no
-  record of who invited whom.
 
 None of these are hard blockers for an instance whose accounts are you and people you
 know. They are the reason not to hand out open registration to strangers.