Invitation-only sign-up

There is no public registration form. Every new person arrives through an invitation created by staff or by an organization owner or admin.

Flow

1. Invite. From the organization's People page (or POST /api/auth/organization/invite-member) an admin enters an email and a role. Accounts stores a pending invitation, valid for seven days, and emails a link of the form https://accounts.dylog.ai/invite/<id>.
2. Open the link. /invite/<id> validates the invitation, stores it in a one-hour dylog.invite cookie, and sends a new person to the sign-up form or an existing person to sign in.
3. Create the account. Sign-up is accepted only when the cookie matches a pending, unexpired invitation for the same email. Because the invitation proved the mailbox, the account is created already email-verified and the person lands directly in the organization.
4. Accept. Existing users accept from the same page; their membership row is created with the invited role.

Re-inviting an address cancels the previous pending invitation. Invitations can be cancelled from the People page at any time.

What the API rejects

Staff can still create users directly from the Better Auth Infra dashboard when an invitation email is not practical.