feat(invites): team invite links — admin create/revoke, public accept (#42)

* feat(branding): white-label — public /branding, admin write, shell theming

app_settings branding.* keys (product name, logo/favicon URLs, accent
color, docs/support links). Public GET /branding so login and shell
theme pre-auth; admin writes via PUT /settings.

useBranding() applies document.title, accent CSS var and favicon;
BrandWordmark replaces hardcoded wordmarks; admin Platform settings
gain a Branding form. MCP containr_branding_get + settings_update.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* feat(invites): team invite links — admin create/revoke, public accept

Admins mint single-use invite links (sha256-hashed token at rest,
optional email binding, configurable TTL). Public endpoints let the
accept page validate the link and register — working even while
public signup is disabled.

- migration + sqlc queries/model for user_invites
- POST /admin/invites (returns one-time token+url), GET list, DELETE revoke
- GET /auth/invites/:token public validation, POST /auth/accept-invite
- CLI containr invites list|create|revoke; MCP invites tools
- /auth/accept-invite page (expired/used/invalid states, bound-email lock)
- Admin page Team invites section: create, copy link, revoke
- OpenAPI + generated types + CLI guide

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

---------

Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

app/frontend/src/lib/api-client.ts

@@ -1972,6 +1972,55 @@ export async function deleteBanner(id: string): Promise<void> {
   await requestJson(`/admin/banners/${id}`, { method: 'DELETE' });
 }
 
+export type Invite = {
+  id: string;
+  email?: string;
+  expires_at: string;
+  used_at?: string;
+  created_at?: string;
+};
+
+export type InviteState = {
+  valid: boolean;
+  used: boolean;
+  expired: boolean;
+  email?: string | null;
+  expires_at: string;
+};
+
+export async function getInvite(token: string): Promise<InviteState> {
+  return requestJson<InviteState>(`/auth/invites/${token}`);
+}
+
+export async function acceptInvite(input: {
+  token: string;
+  name: string;
+  email: string;
+  password: string;
+}): Promise<void> {
+  await requestJson('/auth/accept-invite', { method: 'POST', body: JSON.stringify(input) });
+}
+
+export async function listInvites(): Promise<Invite[]> {
+  const payload = await requestJson<{ invites?: Invite[] }>('/admin/invites');
+  return payload.invites ?? [];
+}
+
+export async function createInvite(input: { email?: string; expiresInHours?: number }): Promise<{
+  invite: Invite;
+  token: string;
+  url: string;
+}> {
+  const body: Record<string, unknown> = {};
+  if (input.email) body.email = input.email;
+  if (input.expiresInHours) body.expires_in_hours = input.expiresInHours;
+  return requestJson('/admin/invites', { method: 'POST', body: JSON.stringify(body) });
+}
+
+export async function revokeInvite(id: string): Promise<void> {
+  await requestJson(`/admin/invites/${id}`, { method: 'DELETE' });
+}
+
 export function serviceStatusClass(status: ServiceStatus): string {
   switch (status) {
     case 'running':