Let users request an invite, show pending requests to admins

[asim]

Replaces the dead-end "invite only" page with a request form. People who want to join can leave their email (+ optional reason) and it goes into a pending queue for admin review.

auth.InviteRequest store (invite_requests.json):

• CreateInviteRequest(email, reason, ip) — new or refreshed entry per email (same address can't flood the list)
• ListInviteRequests() — newest first, pending before invited
• MarkInviteRequestSent(email) — flagged when an invite is sent
• DeleteInviteRequest(email) — admin rejection

Signup flow:

• GET /signup without a valid invite → renderRequestInvitePage (card with email + optional reason + captcha)
• POST /request-invite → captcha check, per-IP rate limit (reuses SignupRateLimit bucket), then CreateInviteRequest + thank-you page. Also added to the CSRF-exempt list (no session yet).

Admin /admin/invite:

• Now lists pending requests with one-click "Send invite" and "Reject" buttons. Sending marks the request as fulfilled and drops it to the bottom of the list.
• Invited requests get a "Resend" button.
• Direct invite form stays at the bottom for ad-hoc invites.

Home page:

• Admin invite link now shows "+ Invite (N waiting)" when there are pending requests, so it's visible without digging into /admin.

https://claude.ai/code/session_01GRGLA9yj7BpqKiyi6xFwnm