Add organisation invitations and one-time-code gateway enrolment

Invitations: token shown once, only its hash stored, 7-day expiry, the
accepting account's email must match. Enrolment codes: 15 minutes,
single use, hashed; POST /auth/enrol returns the farm's existing gateway
token without rotating it and is rate-limited per IP. No email is sent;
the inviter shares the link. Migration 0007, unit tests and
scripts/e2e-onboarding.sh.

drizzle/meta/_journal.json

@@ -50,6 +50,13 @@
       "when": 1793346305671,
       "tag": "0006_octoprint_vendor",
       "breakpoints": true
+    },
+    {
+      "idx": 7,
+      "version": "7",
+      "when": 1793347631289,
+      "tag": "0007_onboarding",
+      "breakpoints": true
     }
   ]
 }