feat: signup toggle, invite links, admin-created users

- New invites table: token-gated signup, optional email lock,
  role/tier override, single-use, expiry.
- SIGNUPS_DISABLED site setting toggle at /admin/settings.
- databaseHooks.user.create gate in auth/server.ts blocks new account
  creation (email + Google OAuth) when disabled unless a valid invite
  cookie is present; applies invite role/tier and marks it consumed.
- /admin/invites: create/list/revoke shareable invite links.
- /admin/users: "Create user" dialog — admin sets email/role/tier,
  account is pre-verified, user gets a set-password email (admin
  never sees a password).
- Signup page reads ?invite=, validates via public
  /api/v1/invites/[token], locks the form when signups are closed
  and no valid invite is present.
- proxy.ts: allowlist /api/v1/invites/ for anonymous invite checks.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/lib/site-settings.ts

@@ -8,7 +8,8 @@ export type SiteSettingKey =
   | "OPENROUTER_DEFAULT_MODEL"
   | "OLLAMA_BASE_URL"
   | "NEXT_PUBLIC_VAPID_PUBLIC_KEY"
-  | "VAPID_PRIVATE_KEY";
+  | "VAPID_PRIVATE_KEY"
+  | "SIGNUPS_DISABLED";
 
 const SECRET_KEYS: SiteSettingKey[] = [
   "OPENAI_API_KEY",
@@ -69,6 +70,10 @@ export async function getAllSiteSettings(): Promise<Record<string, { value: stri
   return result;
 }
 
+export async function isSignupsDisabled(): Promise<boolean> {
+  return (await getSiteSetting("SIGNUPS_DISABLED")) === "true";
+}
+
 export async function setSiteSetting(
   key: SiteSettingKey,
   value: string | null,