feat(provisioning): game-account signup, admin email invites, unlink (2.0)

Phase 5: the account-provisioning backend — link-only stays, plus hybrid
self-signup, an admin email-invite tool, and site-side unlink.

- uoLinkClient.createAccount / unlinkAccount (v2). Password is forwarded to the
  shard (hashed there) and never stored/logged; the end-user browser IP is passed
  for the shard's per-IP cap; actor is stamped server-side.
- Hybrid signup: POST /player/shard/account provisions a game account (its own
  username + password) for the signed-in user and mirrors the link locally. Gated
  by the new game_account_signup setting AND the shard's own mode (mapped 403/409/
  429/400/503). Serves both self-serve signup and the invite-accept game step.
- Email invites: user_invites table (sha256 token hash, single-use, expiring);
  invites model + admin CRUD (POST/GET/DELETE /admin/invites, admin-only) +
  mailer.sendInvite (falls back to returning the accept link if email is off);
  public token-gated accept (GET /auth/invite/:token, POST .../accept) creates the
  user at the invite's preset role and logs them in, bypassing the registration
  gate. Accept is race-safe (atomic single-use; rolls back the user if it loses).
- Admin unlink: DELETE /admin/users/:id/shard/link/:account (admin-only) + local
  mirror drop; account.unlinked ingest reconciles the mirror when a player runs
  [unlink in game. account.audit / account.unlinked are logged (admin channel
  only — never on the public SSE allowlist).

Tests: invites model (hashing, single-use, expiry, revoke) + account.* ingest
reconcile/visibility. Full suite 193/193; swagger regenerated.

Refs .plans/protocol2-integration.md (Phase 5).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/test/invites.test.js

@@ -0,0 +1,78 @@
+const { test, beforeEach, afterEach } = require('node:test')
+const assert = require('node:assert/strict')
+
+// Exercise invite create/lookup/single-use accept against an in-memory fake by
+// monkeypatching the shared db module the model require()s. No DB.
+const db = require('../src/model/invites/invites.db')
+const invites = require('../src/model/invites/invites.model')
+
+let rows
+let nextId
+const saved = {}
+
+beforeEach(() => {
+  rows = []
+  nextId = 1
+  for (const k of ['insert', 'getById', 'findByTokenHash', 'markAccepted', 'revoke']) saved[k] = db[k]
+  db.insert = async ({ tokenHash, email, role, invitedBy, expiresAt }) => {
+    const id = nextId++
+    rows.push({ id, token_hash: tokenHash, email, role, status: 'pending', invited_by: invitedBy ?? null, accepted_user_id: null, expires_at: expiresAt, created_at: new Date(), accepted_at: null })
+    return id
+  }
+  db.getById = async (id) => rows.find((r) => r.id === id) || null
+  db.findByTokenHash = async (h) => rows.find((r) => r.token_hash === h) || null
+  db.markAccepted = async (id, userId) => {
+    const row = rows.find((r) => r.id === id && r.status === 'pending')
+    if (!row) return 0
+    row.status = 'accepted'
+    row.accepted_user_id = userId
+    return 1
+  }
+  db.revoke = async (id) => {
+    const row = rows.find((r) => r.id === id && r.status === 'pending')
+    if (!row) return 0
+    row.status = 'revoked'
+    return 1
+  }
+})
+
+afterEach(() => {
+  for (const k of Object.keys(saved)) db[k] = saved[k]
+})
+
+test('create stores only the token hash, never the plaintext token', async () => {
+  const { invite, token } = await invites.create({ email: 'a@b.com', role: 'player', invitedBy: 1 })
+  assert.ok(token && token.length >= 20)
+  assert.equal(rows[0].token_hash, invites.hashToken(token))
+  assert.notEqual(rows[0].token_hash, token) // hash, not the raw token
+  assert.equal(invite.email, 'a@b.com')
+  assert.equal(invite.role, 'player')
+  assert.equal(invite.status, 'pending')
+})
+
+test('findValidByToken resolves a pending token and rejects a wrong/used one', async () => {
+  const { token } = await invites.create({ email: 'a@b.com', role: 'moderator', invitedBy: 1 })
+  assert.ok(await invites.findValidByToken(token))
+  assert.equal(await invites.findValidByToken('not-a-real-token'), null)
+})
+
+test('accept is single-use — the second accept loses the race', async () => {
+  const { token } = await invites.create({ email: 'a@b.com', role: 'player', invitedBy: 1 })
+  const row = await invites.findValidByToken(token)
+  assert.equal(await invites.accept(row.id, 55), true)
+  assert.equal(await invites.accept(row.id, 66), false) // already consumed
+  assert.equal(await invites.findValidByToken(token), null) // no longer pending
+})
+
+test('an expired invite is not valid (exercises the expiry branch, not a bad token)', async () => {
+  const { token } = await invites.create({ email: 'a@b.com', role: 'player', invitedBy: 1, ttlDays: -1 })
+  // The token itself is correct and the row is pending — only expires_at rejects it.
+  assert.ok(rows[0] && rows[0].status === 'pending')
+  assert.equal(await invites.findValidByToken(token), null)
+})
+
+test('revoke makes a pending invite unusable', async () => {
+  const { invite, token } = await invites.create({ email: 'a@b.com', role: 'player', invitedBy: 1 })
+  assert.equal(await invites.revoke(invite.id), 1)
+  assert.equal(await invites.findValidByToken(token), null)
+})