S12: Onboard a berth tenant by email invite

[xishell]

Persona

Harbor master + new or existing berth tenant

User outcome

As a harbor master, I invite a user to a berth by email so they can join the harbor without me coordinating account creation out-of-band. The invitee clicks the email link, signs up or signs in, and the berth is assigned.

Replaces the ad-hoc "give me your account, I'll assign your berth" workflow. The click-through proves email control, so a brand-new tenant signs up via invite without a separate verification email.

Out of scope: tenant self-service (S10), generalised invite flow for harbor masters or other roles.

Open decisions resolved:

• Token: opaque random, sha256 stored, not JWT
• Berth locked during pending invite, second invite for same berth rejected
• Click-through trusted as email verification for new signups
• Reassignment: confirmation gate + auto-release prior berth in one transaction

Acceptance Criteria

• Harbor master can invite a free berth to an email from the berth detail panel and from a dedicated invites page
• Invitee receives a transactional email with an accept link
• Accept link works for existing accounts (sign-in path) and new accounts (sign-up path, no separate email verification)
• Berth cannot have two pending invites at once; harbor master gets a clear error
• Harbor master can revoke or resend a pending invite
• Accepting assigns the berth and transitions visitor → spot-owner role
• Accepting when invitee already holds another berth shows a confirm gate and releases the prior berth atomically
• Expired or revoked invites cannot be accepted
• Email mismatch (signed in as someone else) is handled with a clear message