Add the owner admin area: invites, people, reset links

Creating an invite previously meant writing SQL by hand, which made the
whole feature unusable in practice. The owner can now create invites
with a use count and expiry, copy the link, show a QR code, and revoke.

QR codes are generated locally by node-qrcode as inline SVG. The CSP
forbids loading from any other origin, so an external generator was not
an option, and img-src 'self' already covers a same-origin SVG.

People lists everyone with what they have added and what their AI use
has cost over 30 days, with suspend, reactivate, per-user AI toggle and
delete. Deleting collects image keys and the minted gateway key id
before the cascade removes the rows, then cleans both up best-effort -
storage or the gateway being unavailable must not leave an account
half-deleted. Guards refuse to suspend or delete yourself or the last
owner.

Password reset links close the gap that came with keeping email and
password sign-in: with no email infrastructure, a member who forgets
their password had no way back in and the owner had no way to help. The
owner generates a single-use 24 hour link and delivers it the same way
as an invite. Issuing one invalidates any earlier unused reset, and the
reset endpoint answers identically for unknown, used and expired tokens
so it cannot be used to probe which exist.

The admin area 404s for members rather than 403ing, so its existence is
not advertised, and every /api/admin handler independently requires the
owner role.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/lib/auth.ts

@@ -9,7 +9,14 @@ import { rateLimit } from "@/lib/rate-limit"
  * prefix, so `/share` also covers `/share/<slug>`. Everything else is private -
  * see the `authorized` callback and the denylist matcher in src/middleware.ts.
  */
-const PUBLIC_ROUTES = ["/login", "/register", "/join", "/invite", "/share"]
+const PUBLIC_ROUTES = [
+  "/login",
+  "/register",
+  "/join",
+  "/invite",
+  "/reset",
+  "/share",
+]
 
 // Email and password only. Google and GitHub were configured but never had
 // credentials set and no account ever linked to them, and dropping them keeps

src/lib/origin.ts

@@ -0,0 +1,15 @@
+/**
+ * The public origin of this deployment.
+ *
+ * `request.url` carries the app's internal bind address (0.0.0.0:3000) because it
+ * runs behind a reverse proxy, so links built from it are unreachable. NEXTAUTH_URL
+ * is the configured public origin and cannot be influenced by a request header.
+ */
+export function publicOrigin(request: Request): string {
+  const configured = process.env.NEXTAUTH_URL
+  if (configured) return configured.replace(/\/$/, "")
+
+  const host = request.headers.get("x-forwarded-host") ?? request.headers.get("host")
+  const proto = request.headers.get("x-forwarded-proto") ?? "https"
+  return host ? `${proto}://${host}` : new URL(request.url).origin
+}