🔒 GATE for referral phase (#5): /api/invitations must be invitedBy-scoped for non-admins (+ self-referral guard, open-signup note)

[PierreBrisorgueil]

Cross-PR review 2026-06-11 — BLOCKING gate before widening create Invitation to regular users (the referral phase, #5):

• InvitationService.list() is find({}) — platform-global, returns every invitee email. The account "My referrals" tab already labels it first-person. The moment regular users gain the ability, this is a PII leak. Fix: invitedBy-scope the list for non-admins (or a dedicated /api/invitations/mine), keep the global list admin-only.
• Add a self-referral guard (alternate-personal-email self-invites become valuable once adapting to front #5 grants credits).
• Document/decide the open-signup hole: claim+finalize are gated on !config.sign.up, so on a sign.up:true deployment the entire referral substrate silently no-ops (no referredBy, no invitation.accepted) while the Referrals tab keeps soliciting invites. Fine for closed-beta the first consumer; must be resolved (finalize-without-claim on open signup, or hide the tab) before any open deployment uses referral.
  Refs: ✨ Referral hook backend — referredBy + invitation.accepted (Node, P8a) #3814, ✨ Referrals account view scaffold (Vue, P8b) Vue#4282, epic 🎯 Decouple invitations from organizations (referral-ready platform invitations) #3808.

[PierreBrisorgueil]

Amounts LOCKED for the first consumer (Trawl, 2026-06-12): referrerUnits: 1000 / refereeUnits: 500 — rationale + the implementation tracker: #3842 (supersedes the dangling in-code TODO(#5) refs). Trawl-side enable issue: https://github.com/comes-io/trawl_node/issues/1449.