feat: UX improvements, webhooks, invite management

- Photo lightbox: ArrowLeft/Right/Escape keyboard navigation
- Growth chart: persistent WHO percentile legend (not hover-only)
- Sleep stats: configurable window selector (18h/19h/20h/21h)
- Quick-add FAB: now visible on desktop (bottom-right corner)
- Invite code reset button in settings (non-admin, PARENT role only)
- Pending email invites: tracked per-token with 7-day expiry, revocable
  from settings UI; new /auth/invite/t/[token] accept page
- Webhooks: Prisma model, CRUD API, HMAC-SHA256 dispatcher wired into
  event.created / growth.created / doctor_note.created; settings UI
- Docker cron service: medication reminders every 15min, milk-expiry
  and daily-digest daily; secured with CRON_SECRET
- Photo uploads persist across redeploys via Docker named volume

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

prisma/schema.prisma

@@ -92,12 +92,36 @@ model Family {
   babies               Baby[]
   eventTemplates       EventTemplate[]
   apiKeys              ApiKey[]
+  webhooks             Webhook[]
+  pendingInvites       PendingInvite[]
   pinnedNote           String?
   pinnedNoteUpdatedAt  DateTime?
   pinnedNoteAuthor     String?
   createdAt            DateTime        @default(now())
 }
 
+model PendingInvite {
+  id        String   @id @default(cuid())
+  familyId  String
+  family    Family   @relation(fields: [familyId], references: [id], onDelete: Cascade)
+  email     String
+  role      UserRole @default(PARENT)
+  token     String   @unique @default(cuid())
+  expiresAt DateTime
+  sentAt    DateTime @default(now())
+}
+
+model Webhook {
+  id         String   @id @default(cuid())
+  familyId   String
+  family     Family   @relation(fields: [familyId], references: [id], onDelete: Cascade)
+  url        String
+  secret     String
+  events     String[]
+  active     Boolean  @default(true)
+  createdAt  DateTime @default(now())
+}
+
 model ApiKey {
   id         String    @id @default(cuid())
   familyId   String