feat: implement user invitation system

- Add InviteToken model and Alembic migration (core.invite_tokens)
- Add invites module: DTOs, service (create/validate/consume), routes
- Register invites router in core router
- Extend auth register endpoint to support invite_token flow:
  - Validate local token, create user via Hub admin API (service account),
    handle existing user (link instead of duplicate), create UserTenant, consume token
- Add GET /auth/register/check endpoint to validate token without consuming
- Add HUB_ADMIN_EMAIL, HUB_ADMIN_PASSWORD, APP_PUBLIC_URL to config
- Frontend: add invite() method and types to users.ts API client
- Frontend: add invite dialog with real roles dropdown to users page
- Frontend: update register page to handle invite flow and user-exists case

backend/alembic/versions/b2c3d4e5f6a7_add_invite_tokens.py

@@ -0,0 +1,72 @@
+"""add invite_tokens table
+
+Revision ID: b2c3d4e5f6a7
+Revises: a1b2c3d4e5f6
+Create Date: 2026-05-06 12:00:00.000000
+"""
+
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+
+revision: str = "b2c3d4e5f6a7"
+down_revision: Union[str, None] = "a1b2c3d4e5f6"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "invite_tokens",
+        sa.Column("id", sa.Integer(), primary_key=True, autoincrement=True),
+        sa.Column("token_hash", sa.String(64), nullable=False, unique=True),
+        sa.Column("tenant_slug", sa.String(100), nullable=False),
+        sa.Column("email", sa.String(255), nullable=False),
+        sa.Column("role", sa.String(50), nullable=False, server_default="user"),
+        sa.Column("created_by", sa.String(255), nullable=False),
+        sa.Column("expires_at", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("used_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("product_ids", sa.JSON(), nullable=True),
+        sa.Column("company_id", sa.Integer(), nullable=True),
+        sa.Column(
+            "created_at",
+            sa.DateTime(timezone=True),
+            server_default=sa.func.now(),
+            nullable=False,
+        ),
+        sa.Column(
+            "updated_at",
+            sa.DateTime(timezone=True),
+            server_default=sa.func.now(),
+            nullable=False,
+        ),
+        schema="core",
+    )
+    op.create_index(
+        "ix_core_invite_tokens_token_hash",
+        "invite_tokens",
+        ["token_hash"],
+        unique=True,
+        schema="core",
+    )
+    op.create_index(
+        "ix_core_invite_tokens_tenant_slug",
+        "invite_tokens",
+        ["tenant_slug"],
+        schema="core",
+    )
+
+
+def downgrade() -> None:
+    op.drop_index(
+        "ix_core_invite_tokens_tenant_slug",
+        table_name="invite_tokens",
+        schema="core",
+    )
+    op.drop_index(
+        "ix_core_invite_tokens_token_hash",
+        table_name="invite_tokens",
+        schema="core",
+    )
+    op.drop_table("invite_tokens", schema="core")