Add invite universal-link landing for app deep-link

Encode the admin invite QR as a clean /invite/<hlv_token> universal-link
that the iOS app intercepts via the AASA wildcard matcher. Add the
matching web route as a thin, shape-validated redirect onto the existing
register flow, and open the path on the public allowlist so an
unauthenticated scanner reaches it. A malformed token segment is
indistinguishable from no invite — no database hit, no enumeration
oracle. The token is never logged.

docs/api/openapi.yaml

@@ -13451,7 +13451,8 @@ components:
               description: Raw invite token (`hlv_<64hex>`). Shown exactly once — never persisted in plaintext.
             url:
               type: string
-              description: Composed registration deep link (`/auth/register?invite=…`).
+              description: Composed invite universal-link (`/invite/<hlv_token>`). On iOS it opens the app onto onboarding
+                registration; in a browser it redirects to `/auth/register?invite=…`.
           required:
             - id
             - createdAt