Add member accounts: invites, registration, login, sessions, ban

Step 2 of the build order. The admin mints an invite link, the recipient
registers with it, and from then on has a session.

- The invite is spent in the same transaction that creates the account, so a
  failed signup leaves the code usable
- Sessions are idle timeouts, 24h or 30 days with remember me, read from a
  cookie or a bearer header, extended at most once a minute
- Ban is a reversible toggle that drops the member's live sessions
- No password minimum; login is rate limited instead, 10 failures per email
  in 15 minutes, cleared by a correct password
- Invite codes render as links carrying ?code=, which the register form
  prefills; PUBLIC_URL makes them pasteable from the loopback admin panel

Tests cover invite spending, the idle timeout, ban, and the rate limiter.

docker-compose.yml

@@ -27,11 +27,12 @@ services:
       # published below, so it stays unreachable from outside without a tunnel or the proxy.
       ADMIN_ADDR: ":8081"
       SECURE_COOKIES: ${SECURE_COOKIES:-true}
+      PUBLIC_URL: ${PUBLIC_URL:-}
     volumes:
       - ./storage:/storage
     ports:
-      - "127.0.0.1:8080:8080"
-      - "127.0.0.1:8081:8081"
+      - "8080:8080"
+      - "8081:8081"
     depends_on:
       postgres:
         condition: service_healthy