feat: staff invite flow — email invitation instead of manual password

- POST /api/hotels/:slug/users: password now optional
  - with password → create active user (email_confirmed=true)
  - without password → create inactive user, send invite email with 7-day token
- POST /api/auth/accept-invite: validates token, sets password, activates
  account, returns JWT for auto-login
- Migration 083: invite_token + invite_expires columns on users
- email.ts: sendInviteEmail() with branded HTML template
- AcceptInvitePage at /invite/:token — set password form, auto-login on success
- AuthContext: loginWithToken() for programmatic session set
- UserModal: password field optional for new users, hint about invite email

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/migrations/083_user_invite.sql

@@ -0,0 +1,3 @@
+-- Staff invite tokens
+ALTER TABLE users ADD COLUMN IF NOT EXISTS invite_token VARCHAR(64);
+ALTER TABLE users ADD COLUMN IF NOT EXISTS invite_expires TIMESTAMPTZ;