Allow OAuth signup through invitation links - #812

Context

A valid invitation unlocks the password registration page when signup is disabled, but that invitation context was lost as soon as the user chose OAuth. The OAuth callback then treated the user as an ordinary disabled-signup attempt and redirected back to login.

Fixes #798.

Changes

• Store the validated invitation ID in the existing session before OAuth begins.
• Reuse one eligibility check across the OAuth callback, registration form, and registration submission.
• Consume the invitation only after the OAuth account has been created successfully.

User impact

Invited users can now complete OAuth/OIDC registration while public signup remains disabled. Users without a usable invitation continue to be rejected.

Verification

• Added an end-to-end regression to TestOIDCLoginPKCE; before the fix it stopped at /-/login instead of /oauth/register.
• The regression runs an actual Opengist HTTP server and local mockoidc HTTP provider through discovery, authorization, token exchange, and userinfo, backed by SQLite with a cookie jar, PKCE, and CSRF-protected registration POST. It verifies both the blocked no-invitation path and successful invited account creation/invitation consumption.
• go test ./internal/web/handlers/auth -run '^TestOIDCLoginPKCE$' -count=1 — passed.
• go test ./internal/web/handlers/auth -count=1 — passed.
• go vet ./internal/web/handlers/auth — passed.
• golangci-lint v2.12.0 run --timeout=20m --disable=errcheck — 0 issues.
• Translation check, npm ci, Vite production build, and embedded Windows backend build — passed.
• go test ./... -p 1 -count=1 — all modified and relevant handler packages passed, including API v1, auth, gist, health, metrics, and settings. The repository-wide run still reports unrelated Windows failures in CLI log-file cleanup, Git symlink/default-branch assumptions, and Git HTTP authentication behavior; representative internal/git failures reproduce on untouched master.