Accept Partnership Invitation

Accept a partnership invitation: create the partner org + its admin user + the active partnership, atomically.

Ported from the direct-DB Next.js route (API proxy sweep slice 6) — previously the ONLY auth-group route with no BE counterpart at all. Faithful quirks kept: invited_at binds the invitation's created_at (the row predates acceptance), plan is 'free_trial' (partnership signups, vs 'trial' for self-serve register), partnership starts 'active' with approved_at=NOW() (accepting IS the approval). One deliberate normalization: the session token is the standard create_access_token (15-min, refreshable) — the old route minted a nonstandard 24h JWT with an extra user_id claim.