Add the owner admin area: invites, people, reset links

Creating an invite previously meant writing SQL by hand, which made the
whole feature unusable in practice. The owner can now create invites
with a use count and expiry, copy the link, show a QR code, and revoke.

QR codes are generated locally by node-qrcode as inline SVG. The CSP
forbids loading from any other origin, so an external generator was not
an option, and img-src 'self' already covers a same-origin SVG.

People lists everyone with what they have added and what their AI use
has cost over 30 days, with suspend, reactivate, per-user AI toggle and
delete. Deleting collects image keys and the minted gateway key id
before the cascade removes the rows, then cleans both up best-effort -
storage or the gateway being unavailable must not leave an account
half-deleted. Guards refuse to suspend or delete yourself or the last
owner.

Password reset links close the gap that came with keeping email and
password sign-in: with no email infrastructure, a member who forgets
their password had no way back in and the owner had no way to help. The
owner generates a single-use 24 hour link and delivers it the same way
as an invite. Issuing one invalidates any earlier unused reset, and the
reset endpoint answers identically for unknown, used and expired tokens
so it cannot be used to probe which exist.

The admin area 404s for members rather than 403ing, so its existence is
not advertised, and every /api/admin handler independently requires the
owner role.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/app/api/admin/users/[id]/reset-link/route.ts

@@ -0,0 +1,57 @@
+import { NextResponse } from "next/server"
+import { randomBytes } from "crypto"
+import { requireOwner } from "@/lib/authz"
+import { prisma } from "@/lib/prisma"
+import { publicOrigin } from "@/lib/origin"
+
+const RESET_TTL_HOURS = 24
+
+/**
+ * Issues a single-use password reset link for a member.
+ *
+ * There is no email infrastructure, so the owner delivers this out of band, the same
+ * way an invite is delivered. Without it a member who forgets their password is
+ * permanently locked out and the owner has no way to help.
+ *
+ * Any unused reset for the same user is invalidated first, so only the newest link works.
+ */
+export async function POST(
+  request: Request,
+  { params }: { params: { id: string } }
+) {
+  const session = await requireOwner()
+  if (session instanceof NextResponse) return session
+
+  const user = await prisma.user.findUnique({
+    where: { id: params.id },
+    select: { id: true, email: true, password: true },
+  })
+  if (!user) return NextResponse.json({ error: "Not found" }, { status: 404 })
+  if (!user.password) {
+    return NextResponse.json(
+      { error: "That account does not use a password" },
+      { status: 400 }
+    )
+  }
+
+  const token = randomBytes(32).toString("hex")
+
+  await prisma.$transaction([
+    prisma.passwordReset.updateMany({
+      where: { userId: params.id, usedAt: null },
+      data: { usedAt: new Date() },
+    }),
+    prisma.passwordReset.create({
+      data: {
+        token,
+        userId: params.id,
+        expiresAt: new Date(Date.now() + RESET_TTL_HOURS * 60 * 60 * 1000),
+      },
+    }),
+  ])
+
+  return NextResponse.json({
+    url: `${publicOrigin(request)}/reset/${token}`,
+    expiresInHours: RESET_TTL_HOURS,
+  })
+}