🔧 Land #3715 signup-gate on master (byte-identical)

[PierreBrisorgueil]

Phase 1 of the invitations↔org decouple epic. Plan: infra/docs/superpowers/plans/2026-06-09-invitations-org-decouple.md (Phase 1).

Land the existing #3715 signup-gate on Devkit Node master, byte-identical to what Trawl prod currently runs (that is what makes the next Trawl /update-stack a no-op). Fixes the front/back split (Vue admin tab #4217 on master, backend not).

⚠️ Derive the manifest — do NOT hand-list. The worktree branch is ahead of the original commit f0e7a83c (it adds auth.signupCapacity.js; f0e7a83c also has auth/config/auth.development.config.js, models/auth.invitation.schema.js, doc/auth.invitations.yml). Run:

git -C comes/trawl_node show --name-status HEAD -- modules/auth | rg -i 'invitation|signupcapacity|auth.controller|auth.routes|auth.development'
git -C pierreb-devkit/Node show --name-status f0e7a83c -- modules/auth

Land exactly that file set, byte-identical to Trawl's deployed version.

Acceptance: invitation endpoints respond on master; admin tab works end-to-end; diff vs the derived manifest empty; /dev:update-project dry-check on Trawl shows a no-op stack diff.

⚠️ Must merge before Phase 2.

---

🛑 Fable review corrections (2026-06-10, code-verified vs origin/master)

This phase is now a VERIFY-NO-OP — nothing to land. #3715 is already on origin/master (git merge-base --is-ancestor f0e7a83c origin/master = true; all invitation files + auth.signupCapacity.js present). Steps: (1) git fetch && checkout origin/master; (2) confirm the 4 endpoints respond; (3) confirm the Vue admin store already hits /api/auth/invitations and the backend serves it (front/back already in sync); (4) confirm git diff origin/master of the invitation files vs trawl_node master is empty; (5) MIGRATIONS.md note. No /feature, no PR. Close this issue as no-op (verification only) with the evidence. The real Trawl divergence (#1347 crypto in auth.service.js/users.service.js) is a P9 concern, not here.

[PierreBrisorgueil]

✅ P1 verification — NO-OP confirmed (closing)

Verified against origin/master (2026-06-10):

• git merge-base --is-ancestor f0e7a83c origin/master → true (feat(auth): invite-only / capped signup gate #3715 already merged on master).
• 9/9 invitation-surface files byte-identical between trawl_node origin/master and pierreb-devkit/Node origin/master: auth.invitation.{controller,service,repository,model.mongoose,schema,policy}.js, auth.signupCapacity.js, auth.routes.js, auth.controller.js.
• Routes block present on devkit master (/api/auth/invitations + /verify/:token); Vue admin store hits ${apiBase()}/auth/invitations → front/back already in sync.

The 'backend not on master / front-ahead-of-back' premise was an artifact of a local checkout 115 commits behind. Nothing to land. The real Trawl divergence (#1347 crypto in auth.service.js/users.service.js) is a P9 concern, not P1.

→ Proceeding to P2 (#3810).