🔧 invitation ops: copy-link/resend, revoke status-guard, duplicate-pending guard

[PierreBrisorgueil]

Cross-PR review 2026-06-11:

• No copy-link/resend: create() emails best-effort (silent skip if mailer unconfigured, .catch logs only) and the list strips the token → a failed invite email is irrecoverable from the UI (revoke + re-create = same risk). The CREATE response does include the token: add a one-time copy-link affordance in both views, and/or a resend endpoint.
• revoke() has no status guard ({_id} filter only): can revoke an ACCEPTED invite via API (corrupts future referral counts — flips status while keeping acceptedAt/acceptedUserId) and revoke mid-claim (benign race — in-flight signup still succeeds, attribution skipped; document). Fix: filter {_id, status:'pending'} → 409 otherwise.
• No duplicate-pending guard: the same email can hold N pending invites (token path burns the clicked one, OAuth burns the newest, siblings zombie as Pending; with different inviters, referredBy = whichever won). Fix: 409 or revoke-supersede in create().
  Refs: 🔒 Invitation edge-case hardening #3811, epic 🎯 Decouple invitations from organizations (referral-ready platform invitations) #3808.