feat(adminsite): people, instance members and one password

The members panel is absent for self-hosted instances rather than disabled:
the backend refuses those, and a panel rendering controls the server will
reject is a panel that lies.

/auth/me now reports the caller's account role, so the UI hides what the
backend would refuse rather than discovering it in an error toast.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

adminsite/app/verify/page.tsx

@@ -1,12 +1,13 @@
 "use client";
 
 import { useQuery } from "@tanstack/react-query";
-import { useSearchParams } from "next/navigation";
+import { useRouter, useSearchParams } from "next/navigation";
 import Link from "next/link";
-import { Suspense } from "react";
+import { Suspense, useEffect } from "react";
 import { api } from "@/lib/api";
 
 function Verify() {
+    const router = useRouter();
     const token = useSearchParams().get("token") ?? "";
     const { data, error, isLoading } = useQuery({
         queryKey: ["verify", token],
@@ -15,6 +16,17 @@ function Verify() {
         retry: false,
     });
 
+    // An invitation and a verification link are the same shape, and someone will
+    // paste one into the other. The backend leaves an invite token unspent and
+    // says so; send them where they can actually finish.
+    const needsPassword = data?.needs_password === true;
+    useEffect(() => {
+        if (needsPassword) {
+            router.replace(`/accept-invite?token=${encodeURIComponent(token)}`);
+        }
+    }, [needsPassword, token, router]);
+    if (needsPassword) return <Message title="One moment…" body="Taking you to set a password." />;
+
     if (!token)
         return (
             <Message