feat: staff invite flow — email invitation instead of manual password

- POST /api/hotels/:slug/users: password now optional
  - with password → create active user (email_confirmed=true)
  - without password → create inactive user, send invite email with 7-day token
- POST /api/auth/accept-invite: validates token, sets password, activates
  account, returns JWT for auto-login
- Migration 083: invite_token + invite_expires columns on users
- email.ts: sendInviteEmail() with branded HTML template
- AcceptInvitePage at /invite/:token — set password form, auto-login on success
- AuthContext: loginWithToken() for programmatic session set
- UserModal: password field optional for new users, hint about invite email

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/lib/api.ts

@@ -201,6 +201,10 @@ export const api = {
     resetPassword: (token: string, password: string) =>
       req<{ ok: boolean }>('POST', '/api/auth/reset-password', { token, password }),
 
+    acceptInvite: (token: string, password: string) =>
+      req<{ access_token: string; user: import('../types').User }>(
+        'POST', '/api/auth/accept-invite', { token, password }),
+
     resendConfirmation: (email: string) =>
       req<{ ok: boolean }>('POST', '/api/auth/resend-confirmation', { email }),
   },