Invite App User

Bring someone NEW into the org and give them this app, in one step.

add_app_user can only shuffle access within the org's existing population, so adding a colleague meant leaving the app entirely, finding the organization page, inviting them there, coming back, and granting the app. This is that round trip collapsed.

It is org-owner/admin only, deliberately. An app admin who is a plain org member must not be able to widen the org — that containment property is what makes a per-app grant a real boundary, and it is asserted by test_an_app_admin_cannot_add_a_non_member_to_their_app. Such a caller keeps the picker and gets 403 here.

require_team runs before any row is written, exactly as invite_member does: a refused invite must not leave a pending user squatting the address.