feat(admin): invite people to an account and give them roles

An invitation carries no password. The HQ password is what signs someone
into every instance they are granted, so a password the inviter chose would
be a shared credential to all of them — the invited row has an empty hash,
which cannot authenticate, until /accept-invite sets one.

Removing a person revokes every projected instance user first, and refuses
outright if any of those is an instance's last owner.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

admin/internal/mail/mail.go

@@ -143,6 +143,18 @@ func SendVerification(to, token string) error {
 			link+"\n\nThis link expires in 24 hours.\n")
 }
 
+// SendInvite asks someone to join an existing account and set their own
+// password. It names the account, because an unexpected invitation from a
+// service you have never used is otherwise indistinguishable from spam.
+func SendInvite(to, accountName, token string) error {
+	link := fmt.Sprintf("%s/accept-invite?token=%s", cfg.PublicURL, token)
+	return send(to, "You have been invited to "+sanitizeHeader(accountName)+" on Vantage",
+		fmt.Sprintf("You have been invited to join %s on Vantage.\n\n"+
+			"Set your password and finish joining:\n\n%s\n\n"+
+			"This link expires in 24 hours. If you were not expecting this, ignore it — "+
+			"nothing happens until you open the link.\n", accountName, link))
+}
+
 // SendLicense delivers the blob inline. It is signed public data, not a secret —
 // it is useless on any instance other than the one it names.
 func SendLicense(to, instanceName, blob string) error {