Public Invite

Unauthenticated BY DESIGN — this is what the invite landing page reads before the invitee has any session at all, and requiring a JWT here is exactly the bug it fixes (the app bounced a session-less invitee to /logout).

Gated by the signed token from the invite email and nothing else; it returns only the fields on PublicInviteResponseDTO (workspace name, inviter's display name, the role, their own address) and 404s identically for every failure. Rate-limited per IP on top of the token's unguessability so it can't be hammered.