PROPOSAL: Invite-based user onboarding (instead of admins setting initial passwords)

Summary

Add an invite flow for adding users to a Coroot project, as an alternative to the current process where an admin has to manually create each user and choose their initial password.

Current behavior

Today, in Project Settings > Organization > Users, an admin clicks Add user and must fill in the email, name, role, and an initial password. The admin then has to communicate that password to the new user out-of-band (chat, email, etc.).

This has a few drawbacks:

• The admin knows every user's initial password.
• Passwords get shared over insecure channels.
• There's no concept of a "pending" user who hasn't onboarded yet.
• New users typically should change the admin-set password anyway, adding an extra step.

Proposed behavior

Replace (or supplement) the "admin sets the password" step with an invite flow:

1. Invite a member: Admin enters the new user's email and selects a role. No password field.
2. Generate an invite link: Coroot generates a unique, time-limited invite token/link. The admin can copy the invite link and share it manually.
   • Optional/follow-up: if SMTP is configured, automatically email the invite to the user. If SMTP isn't configured, fall back to copy-link only.
3. User sets their own password: The invitee opens the link, sets their own name (optional) and password, and the account becomes active. The admin never sees the password.
4. Pending invites in the members list: The Users table shows pending invitees inline with an "Invited" status, alongside active users. For each pending invite the admin can:
   • Copy invite link (also used to regenerate/renew an expired link)
   • Revoke the invite
5. Expiry: Invite links expire after a configurable period. Renewing simply generates a fresh link via "Copy invite link"; no need to delete and re-invite.

Implementation notes / pointers

Relevant existing code:

• db/user.go: AddUser / UpdateUser currently require a bcrypt-hashed password at creation time.
• api/api.go: Users handler with create / update / delete actions.
• api/forms/auth.go: UserForm (currently has a required Password field on create).
• front/src/views/Users.vue: Users table + add/edit dialog (the dialog currently requires a password on create).

Suggested additions:

• A new invites concept (or a status / pending flag + invite token on the user record) with token, role, created/expiry timestamps.
• New API actions: invite, revoke-invite, and a public endpoint to accept an invite + set password.
• A new public "Accept invite" page in the frontend for setting the password.
• Show pending invites with status and copy-link/revoke actions in Users.vue.

Backward compatibility

• Keep the existing "admin sets password" path available (or behind a flag) so air-gapped/manual setups aren't broken.
• The default admin user behavior is unchanged.

Benefits

• Admins no longer handle other users

Out of scope (for now)

• Bulk invites and invite-by-email-domain.

These could be follow-ups if the base feature lands.

---

I'd be happy to work on this if the approach sounds good. Open to feedback on the design before I start.