Accept Invite

Server-to-server: consume an invitation for an authenticated user.

Called by /api/invite/consume on the web side after OAuth returns. Validates the token, the bound email, and not-expired/not-revoked. Creates the user (or moves an existing pending user into the inviting org as active).

Internal-secret gated because the web layer is trusted to have just completed OAuth — token alone wouldn't be enough proof of identity.