feat: signup toggle, invite links, admin-created users

- New invites table: token-gated signup, optional email lock,
  role/tier override, single-use, expiry.
- SIGNUPS_DISABLED site setting toggle at /admin/settings.
- databaseHooks.user.create gate in auth/server.ts blocks new account
  creation (email + Google OAuth) when disabled unless a valid invite
  cookie is present; applies invite role/tier and marks it consumed.
- /admin/invites: create/list/revoke shareable invite links.
- /admin/users: "Create user" dialog — admin sets email/role/tier,
  account is pre-verified, user gets a set-password email (admin
  never sees a password).
- Signup page reads ?invite=, validates via public
  /api/v1/invites/[token], locks the form when signups are closed
  and no valid invite is present.
- proxy.ts: allowlist /api/v1/invites/ for anonymous invite checks.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

packages/db/src/migrations/0015_aromatic_lester.sql

@@ -0,0 +1,16 @@
+CREATE TABLE "invites" (
+	"id" text PRIMARY KEY NOT NULL,
+	"token" text NOT NULL,
+	"email" text,
+	"role" "user_role" DEFAULT 'user' NOT NULL,
+	"tier" "tier" DEFAULT 'free' NOT NULL,
+	"created_by_id" text NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"expires_at" timestamp,
+	"used_at" timestamp,
+	"used_by_id" text,
+	CONSTRAINT "invites_token_uniq" UNIQUE("token")
+);
+--> statement-breakpoint
+ALTER TABLE "invites" ADD CONSTRAINT "invites_created_by_id_users_id_fk" FOREIGN KEY ("created_by_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "invites" ADD CONSTRAINT "invites_used_by_id_users_id_fk" FOREIGN KEY ("used_by_id") REFERENCES "public"."users"("id") ON DELETE set null ON UPDATE no action;

packages/db/src/migrations/meta/_journal.json

@@ -106,6 +106,13 @@
       "when": 1782984288632,
       "tag": "0014_late_marvex",
       "breakpoints": true
+    },
+    {
+      "idx": 15,
+      "version": "7",
+      "when": 1783105214683,
+      "tag": "0015_aromatic_lester",
+      "breakpoints": true
     }
   ]
 }

packages/db/src/schema/tiers.ts

@@ -8,7 +8,7 @@ import {
   unique,
 } from "drizzle-orm/pg-core";
 import { relations } from "drizzle-orm";
-import { users, tierEnum } from "./users";
+import { users, tierEnum, userRoleEnum } from "./users";
 
 export const tierDefinitions = pgTable("tier_definitions", {
   tier: tierEnum("tier").primaryKey(),
@@ -50,6 +50,26 @@ export const siteSettings = pgTable("site_settings", {
   updatedById: text("updated_by_id").references(() => users.id, { onDelete: "set null" }),
 });
 
+export const invites = pgTable("invites", {
+  id: text("id").primaryKey(),
+  token: text("token").notNull(),
+  email: text("email"),
+  role: userRoleEnum("role").notNull().default("user"),
+  tier: tierEnum("tier").notNull().default("free"),
+  createdById: text("created_by_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  createdAt: timestamp("created_at").notNull().defaultNow(),
+  expiresAt: timestamp("expires_at"),
+  usedAt: timestamp("used_at"),
+  usedById: text("used_by_id").references(() => users.id, { onDelete: "set null" }),
+}, (t) => [
+  unique("invites_token_uniq").on(t.token),
+]);
+
 export const userUsageRelations = relations(userUsage, ({ one }) => ({
   user: one(users, { fields: [userUsage.userId], references: [users.id] }),
 }));
+
+export const invitesRelations = relations(invites, ({ one }) => ({
+  createdBy: one(users, { fields: [invites.createdById], references: [users.id] }),
+  usedBy: one(users, { fields: [invites.usedById], references: [users.id] }),
+}));