Admin generates invite token for self-registration #107

Context

Issue #2.18 adds the Invite entity and gates POST /auth/register with invite-token validation. This issue adds the admin endpoint to actually generate tokens so the self-registration flow can be used end-to-end.

This is post-v1.0. Admin-creates-user (POST /api/v1/users, issue #99) covers all provisioning for v1.0. This endpoint is only needed when a UI-driven self-registration flow is introduced.

Endpoint

POST /api/v1/users/invites

Caller must hold the IsAdmin claim.

Behaviour

• Generates a cryptographically random plain token: Convert.ToBase64String(RandomNumberGenerator.GetBytes(32))
• Stores the SHA-256 hash in the Invites table (entity added by Set up solution structure #2.18)
• Sets CreatedAt = now, ExpiresAt = now + configured days (default 7 days, configurable)
• Returns 201 Created with { "token": "...", "expiresAt": "..." } — plain token returned once only
• The admin sends the token to the invitee out-of-band

Notes

Requires #2.18 to be merged first (provides Invite entity + IInviteRepository).