Recovery snapshot: AXI-2 email invitations

[Codename-11]

Recovery snapshot — do not merge as-is

This draft preserves the uncommitted AXI-2 email-invitation implementation found on the server before Forge development moves to a local PC.

Preserved scope

• tenant-scoped invitation records and lifecycle
• hashed expiring bearer tokens
• SMTP/Resend delivery abstraction
• invite acceptance route and workspace member-management UI
• resend, revoke, expiry, duplicate, and delivery-lock behavior
• integration coverage and configuration examples

Known recovery hazards

• the branch base is 42 commits behind current main
• DEVLOG.md was accidentally collapsed to one line in the recovered worktree; restore current history and append the preserved entry during reconciliation
• migrations 0104_workspace_invitations and 0105_invitation_delivery_lock collide with migrations now on main; replace them with current timestamped migration directories
• package and lockfile changes need to be rebuilt against v0.27.0

Required reconciliation

• rebase/port the feature onto current main
• restore DevLog history
• regenerate migration names and Prisma client
• review tenancy, token, email-delivery, and concurrency behavior
• run lint, typecheck, complete unit/integration suite, production build, and Playwright

Preservation validation

• exact dirty worktree staged intentionally
• no credential/private-key patterns found; only .env.example placeholders are included
• git diff --cached --check passed before commit
• branch pushed at e6205270bf3729c6a73771d96f12ca02fa569c18