Invite a member

Invite someone to the workspace by email, with an optional role (defaults to member). They receive an email and can join with that role, which makes this outward-facing (Tier B). An fsk_ key has no session, so it acts as the human who minted it: their live role is the anti-escalation ceiling — a key can never invite above what its creator could grant today — and a key whose creator was removed or demoted is refused with 403. Scope: members:manage.