The OpenAPI document describes the admin's account routes: accounts, roles, ceilings, grants, suspend, verify and invites #4866

Intent: an admin's harness manages people through OpenAPI alone.

Done:

• [ ] rows in src/contract/openapi.ts for GET /api/v1/admin/accounts, DELETE /api/v1/admin/accounts/{username}, POST /api/v1/admin/accounts/{username}/ role, ceiling, model-grant, suspend, unsuspend and verify, and GET/POST /api/v1/admin/invites with DELETE /api/v1/admin/invites/{id}, placed right after the existing POST /api/v1/apps row
• [ ] the invite row says that the link is shown once

Each row says what the route answers (the shape in its summary, exactly as the handler answers today), whether it needs a token (auth) and which scope, and its body fields, query and refusals, as the existing rows do. Use the methods src/http/api.ts registers. If a route needs "put" and #4844 has not yet added it to the Route method type, leave that route out and say so in the pull; do not add it here, because other issues would collide on that line. test/openapi.test.ts must still pass; add test/openapi-oa-acct.test.ts asserting each new path and method is in the served document. Other issues add rows in parallel, so put these exactly where named and nowhere else.