Add email-based invites and email confirmation in one flow

Family admins can now invite new members by email. The recipient gets a
templated email with a single-use, time-limited join link; clicking it
opens the registration form bound to the invite, and submitting the
form simultaneously consumes the invite and marks the email confirmed.
Self-registration via the shareable family code remains available.

Backend
- New Invite entity (token hash only — raw token never stored), with
  per-family uniqueness on the active hash.
- User gains nullable Email and EmailConfirmedAt; partial unique index
  so legacy rows with no email do not collide.
- /api/family/invites — admin endpoints to list pending, issue, resend
  (rotates the token), and revoke.
- /api/auth/invite/{token} — public lookup returning email + family name
  so the registration form can show "you have been invited to X".
- /api/auth/register accepts InviteToken; the invite vouches for the
  email, so any client-supplied email field is ignored. Falls back to
  FamilyCode when no invite token is present.
- AppUrlOptions / AppBaseUrl plumbed through so emails build absolute
  links to the deployed frontend.

Frontend
- /login reads ?invite=<token>, looks it up, and switches the form into
  invite-registration mode (pre-binding to the invited email + family).
- /family admin section gains an invite-by-email form, a pending list,
  and resend/revoke actions with a confirmation modal.

Tests
- 14 new integration tests covering: admin issue, member-forbidden,
  lookup, valid/expired/consumed/unknown-token registration, resend
  rotation, revocation, pending-only list filter, and conflict for
  inviting an existing member. RecordingEmailSender captures dispatched
  messages so tests can assert on the link without standing up SMTP.

src/backend/YesChef.Api/Entities/Invite.cs

@@ -0,0 +1,25 @@
+namespace YesChef.Api.Entities;
+
+/// <summary>
+/// Single-use, time-limited invitation to join a family. The raw token is sent
+/// to the recipient by email; only its SHA-256 hash is stored, so a database
+/// leak doesn't yield active invites.
+/// </summary>
+public class Invite
+{
+    public int Id { get; set; }
+    public int FamilyId { get; set; }
+    public Family Family { get; set; } = null!;
+
+    public required string Email { get; set; }
+    public required string TokenHash { get; set; }
+
+    public int IssuedByUserId { get; set; }
+    public User IssuedByUser { get; set; } = null!;
+    public DateTime IssuedAt { get; set; } = DateTime.UtcNow;
+    public DateTime ExpiresAt { get; set; }
+
+    public DateTime? ConsumedAt { get; set; }
+    public int? ConsumedByUserId { get; set; }
+    public User? ConsumedByUser { get; set; }
+}