Create User

Create a user (admin). Hashes password if present; associates companies.

Memberships come from memberships (id + role) or the legacy companies array (roles default member) — never both (422).

invite (admin surface P12) closes the hole this route shipped with. Omitting password hashes a random string, so the row was created, the memberships attached, a 201 returned — and the person had no way in. Their only route back was asking an administrator to invent a password and send it over some channel, which is both a support burden and the worst way to distribute a credential. With invite (the default) a create WITHOUT a password mints a single-use code and emails it.

Reuses the password-reset OTP rather than a second single-use credential type: one expiry, one consumption rule, one revocation path — and create_otp already invalidates outstanding codes, so an invite followed by a self-service reset cannot leave two live codes.

invite_mail_attempted in the response says whether SMTP was even configured, never whether the mail arrived. On a stack with no SMTP_HOST it is false and the code exists with nobody told — an operator who reads "invited" and moves on has stranded the person they were provisioning.