Accept an invitation and create the member account

No authentication of any kind — this is how someone with no BriefGate account yet joins one. The token from the invite email is the entire proof of identity; do not call this with an Authorization header, it is neither required nor checked. On success the response sets the same session cookie POST /v1/auth/login does — the new member is signed straight into the dashboard.

The token is single-use and the claim is atomic: of two concurrent requests carrying the same token (e.g. a double-clicked submit button), exactly one succeeds. An unknown token, an expired one, and one that was already accepted (by this request or a concurrent one) are deliberately indistinguishable — all three return the identical 401, so this cannot be used to probe which invitations exist or were already claimed.