Accept an invitation

Accept a workspace invitation token and receive a session token pair.

The raw token from the invitation email is the credential for the ordinary case: an invitee with no existing account accepts anonymously and lands logged in (access + refresh tokens) scoped to the invitation's tenant with the invited role. An Authorization header is optional, and needed only to complete the one case below that a token alone cannot: POST anonymously first, and send the bearer only if this endpoint asks for it.

Errors:

• 404: unknown token.
• 400: expired or revoked invitation.
• 409: invitation already accepted, the workspace membership could not be linked to the account that accepted it, or the workspace has no active owner and the invitation would bring back its last owner row with a lower role (errors[0].type is last_owner). The second is not retryable by the invitee: the acceptance is rolled back and an admin has to sort the membership out, most often because that person already belongs to this workspace under another address. The third is rolled back too and the invitation stays pending: the workspace needs an owner restored, which Patricia support escalates.
• 401 INVITATION_SIGN_IN_REQUIRED: the invited address already has an account. Sign in, then POST this endpoint again with the bearer token; the invitation is untouched and still usable.
• 403 INVITATION_WRONG_ACCOUNT: a bearer was sent, but it is signed in as somebody other than the invited address's owner — most often a forwarded link. Sign in as the invited address and retry. The invitation is untouched, and the message deliberately does not say who it was for.
• 403 FORBIDDEN: every other refusal on this route — the account needs recovery, the account can no longer be used, the invitation went to a secondary address rather than the account's main one, the two identity planes disagree about who is joining, or the membership did not come out active. The invitation stays pending in all of them. They share the generic code on purpose: the dashboard shows the message, and there is no action the invitee can take that a distinct code would unlock. Deliberately not enumerated in the response description — a count there goes stale the first time one is added.