Add teammates. Each gets their own account and their own claim link.

THE ORGANIZATION IS FIXED BY THE SESSION. This route takes addresses and nothing else -- no hs_id, no organization name -- so there is no version of it that adds somebody to a health system the caller is not already in. That is the same property /hs/payouts holds and for the same reason.

Adding an address that already has an active account on this organization ROTATES nothing and sends nothing: re-adding a colleague by accident must not invalidate the password they are already using.

NOTHING THAT GUARDS THE NEW ACCOUNT TRAVELS BY EMAIL. Each address gets a one-time claim link and sets its own password on arrival, which is also where the account finally gets a NAME: it had none before, so the portal header rendered the derived username at a hospital executive.