feat: implement user invitation system

- Add InviteToken model and Alembic migration (core.invite_tokens)
- Add invites module: DTOs, service (create/validate/consume), routes
- Register invites router in core router
- Extend auth register endpoint to support invite_token flow:
  - Validate local token, create user via Hub admin API (service account),
    handle existing user (link instead of duplicate), create UserTenant, consume token
- Add GET /auth/register/check endpoint to validate token without consuming
- Add HUB_ADMIN_EMAIL, HUB_ADMIN_PASSWORD, APP_PUBLIC_URL to config
- Frontend: add invite() method and types to users.ts API client
- Frontend: add invite dialog with real roles dropdown to users page
- Frontend: update register page to handle invite flow and user-exists case

docker-compose.yml

@@ -71,6 +71,7 @@ services:
       - HUB_URL=${HUB_URL:-http://host.docker.internal:8001}
       - HUB_ADMIN_EMAIL=${HUB_ADMIN_EMAIL:-}
       - HUB_ADMIN_PASSWORD=${HUB_ADMIN_PASSWORD:-}
+      - APP_PUBLIC_URL=${APP_PUBLIC_URL:-http://localhost:3001}
       - CSV_IMPORT_STORAGE=${CSV_IMPORT_STORAGE:-minio}
       - S3_ENDPOINT_URL=${S3_ENDPOINT_URL:-http://minio:9000}
       - S3_ACCESS_KEY=${S3_ACCESS_KEY:-${MINIO_ROOT_USER:-minioadmin}}