Adds an OSS invitation-code system gating public signups:
- ent InvitationCode entity (code, group override, max uses, expiry, use count)
- atomic consume inside the registration transaction; rolls back with user creation
- invitation_code_required setting, exposed via public site config
- signup form field when enforced; admin CRUD under Users - Invitation codes
- codes generated with crypto-random; admin mutations require ScopeAdminWrite
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>