invites: an admin lets one person register while registration stays closed

Until now adding a second person meant re-opening registration to the
whole internet while they signed up (#2939 §1). An admin now makes an
invite in Settings: a link that works once, expires (7 days by default,
1 to 30), and can be pinned to one email address. Only the token's hash
is stored, so the link is shown once.

POST /api/auth/register takes `invite`. Redemption is one conditional
UPDATE inside the transaction that creates the account, so two people
racing one link can't both get in, and a taken email leaves the invite
unused. Every refusal says "invalid or expired invite". The register
page reads ?invite= and opens even while registration is closed.

Refs #5172

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

frontend/src/stores/session.ts

@@ -29,8 +29,8 @@ export const useSessionStore = defineStore("session", () => {
     user.value = await repo.auth.login(email, password);
   }
 
-  async function register(email: string, password: string, displayName: string): Promise<void> {
-    user.value = await repo.auth.register(email, password, displayName);
+  async function register(email: string, password: string, displayName: string, invite?: string): Promise<void> {
+    user.value = await repo.auth.register(email, password, displayName, invite);
   }
 
   async function logout(): Promise<void> {