Spend an invitation link: set the account's first password and make it ACTIVE, and link it to
Signing in
Spend an invitation link: set the account's first password and make it ACTIVE, and link it to
the person behind any other account its address already names.
Callable without a token, because the person accepting has no account yet. The link is the credential — single use, one week, stored as a sha256. No session is issued: choosing a password and proving you know it are two different claims.

