- POST /api/hotels/:slug/users: password now optional
- with password → create active user (email_confirmed=true)
- without password → create inactive user, send invite email with 7-day token
- POST /api/auth/accept-invite: validates token, sets password, activates
account, returns JWT for auto-login
- Migration 083: invite_token + invite_expires columns on users
- email.ts: sendInviteEmail() with branded HTML template
- AcceptInvitePage at /invite/:token — set password form, auto-login on success
- AuthContext: loginWithToken() for programmatic session set
- UserModal: password field optional for new users, hint about invite email
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
