Tighten invitation lifecycle

Invitation links work once, opening one never signs in an existing account, onboarding runs only on a new site, and admins manage invitation records.