A test proves invite links: only an admin mints, lists or revokes, and the token is in no event, log line or listing #7513

Intent: secure by default. An invite token is a key to the forge, so it appears once, to the admin who minted it, and nowhere else. No test imports src/actions/invites.ts directly today.

Done:

• [ ] A new test/invites-action.test.ts covers mint, list and revoke. An admin's mint returns the link once, and list never carries the token or its hash. Every event the bus appended for the mint and the revoke carries no token, which the test checks by scanning the payloads. A non-admin and a guest get not_found for all three. A revoked link no longer signs anyone up. days outside its bounds is refused.
• [ ] If any of these fail, fix src/actions/invites.ts, and the pull says what was wrong.

Files: a new test, and src/actions/invites.ts only if the test finds a fault.