invites: an admin lets one person register while registration stays closed

Until now adding a second person meant re-opening registration to the
whole internet while they signed up (#2939 §1). An admin now makes an
invite in Settings: a link that works once, expires (7 days by default,
1 to 30), and can be pinned to one email address. Only the token's hash
is stored, so the link is shown once.

POST /api/auth/register takes `invite`. Redemption is one conditional
UPDATE inside the transaction that creates the account, so two people
racing one link can't both get in, and a taken email leaves the invite
unused. Every refusal says "invalid or expired invite". The register
page reads ?invite= and opens even while registration is closed.

Refs #5172

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

frontend/src/views/RegisterView.vue

@@ -1,6 +1,6 @@
 <script setup lang="ts">
-import { ref } from "vue";
-import { useRouter } from "vue-router";
+import { computed, ref } from "vue";
+import { useRoute, useRouter } from "vue-router";
 import { useSessionStore } from "../stores/session";
 import { useConfigStore } from "../stores/config";
 import BaseInput from "../components/BaseInput.vue";
@@ -10,6 +10,11 @@ import { errorMessage } from "../api/errors";
 const session = useSessionStore();
 const config = useConfigStore();
 const router = useRouter();
+const route = useRoute();
+
+// The token from an invite link (/register?invite=…). It lets this one account in
+// while registration is closed.
+const invite = computed(() => (typeof route.query.invite === "string" ? route.query.invite : ""));
 
 const displayName = ref("");
 const email = ref("");
@@ -25,7 +30,7 @@ async function submit() {
   }
   loading.value = true;
   try {
-    await session.register(email.value, password.value, displayName.value);
+    await session.register(email.value, password.value, displayName.value, invite.value || undefined);
     await router.replace("/");
   } catch (e) {
     error.value = errorMessage(e, "Could not create your account.");
@@ -46,8 +51,10 @@ async function submit() {
           width="48"
           height="48"
         />
-        <h1 class="text-2xl font-bold tracking-tight">Create your space</h1>
-        <p class="mt-1 text-sm text-neutral-500 dark:text-neutral-400">Start capturing in seconds.</p>
+        <h1 class="text-2xl font-bold tracking-tight">{{ invite ? "You're invited" : "Create your space" }}</h1>
+        <p class="mt-1 text-sm text-neutral-500 dark:text-neutral-400">
+          {{ invite ? `Create your account on ${config.siteName}.` : "Start capturing in seconds." }}
+        </p>
       </div>
 
       <form class="flex flex-col gap-4" novalidate @submit.prevent="submit">

frontend/src/views/SettingsView.vue

@@ -3,6 +3,7 @@ import { computed, onMounted, ref, watch } from "vue";
 import { api } from "../api/client";
 import { useConfigStore } from "../stores/config";
 import BaseButton from "../components/BaseButton.vue";
+import InviteList from "../components/InviteList.vue";
 import { errorMessage } from "../api/errors";
 
 interface SettingItem {
@@ -170,5 +171,9 @@ onMounted(load);
         <span v-if="error" class="text-sm text-red-600 dark:text-red-400">{{ error }}</span>
       </div>
     </form>
+
+    <!-- Outside the settings form: each invite action saves on its own, and the
+         form's Save button has nothing to do with them. -->
+    <InviteList v-if="items.length" class="mt-10" />
   </div>
 </template>