Invites, part 2: a forge set to signup = invite makes an account only through a valid link, and new forges default to invite #2336

Part of #1143.

Done looks like:

• [ ] When signup = invite, /signup?invite=<token> and POST /api/v1/users with invite make an account only from a valid, unused, unexpired link, and they use the link up. Anything else is refused with one plain sentence that does not say whether the token ever existed.
• [ ] New forges (spawned or fresh) default to invite. Existing forges keep the value they already have.
• [ ] Using a link goes in the audit.
• [ ] Tests: the happy path; reuse, expiry and revocation are each refused; a new forge defaults to invite. Run every test file that signs people up (grep -l signup test/*.ts).

Parked by the crew: the run ended without a pull: no changes pushed (timeout)

Parked by the crew: the check failed ("what I can do in the terminal > (unnamed)") and the decider saw no point in another try (pull #2408 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the run ended without a pull: no changes pushed (timeout)
2. the check failed ("what I can do in the terminal > (unnamed)") and the decider saw no point in another try (pull #2408 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Split into #2417 (web and API redeem an invite), #2418 (the terminal's create-account screen) and #2419 (new forges default to invite). Try 1 timed out doing all three, and try 2 went red on test/tui-can.test.ts, the terminal's own suite. The terminal is now its own piece and says how that suite may change.