Accept a team invitation

Consume an invite token → make the SIGNED-IN invitee an active org member.

Requires the invitee's Supabase bearer whose email Supabase Auth CONFIRMS (403 email_not_confirmed / sso_email_binding_refused otherwise) and equals the invited address (else 409 invite_email_mismatch; the invite stays pending) — a forwarded or leaked token cannot seat a different account. The inviter must still be able to grant the invite (409 invite_inviter_inactive), and a removed member is reactivated only by an invite sent AFTER the removal (409 invite_predates_removal). The row is bound to the accepting uid; their old API keys stay revoked. The identity's home link is created when it has none, and moved to this org when it pointed at the identity's own personal org (so <app> login joins this team).