Invites: accept an invite via deep link (landing, sign-in, claim) #60

Part of #57 — Email invites for lists and documents (invite someone who has no account yet)

The receiving half, and the one with the most edge cases.

• App Link intent filters for the invite URLs → resolve with GET /api/{lists,documents}/invite/{token}
  and show a landing screen with what is being shared and at what role.
• Signed out: route through login/register and return to the invite afterwards.
• Signed in as the wrong or an unverified address: say so plainly — the invite is bound to the
  invited address and requires it to be verified.
• Claim with POST /api/{lists,documents}/invite/{token}, then open the list/document.
• Revoked / expired / invalid → the friendly "no longer valid" state, never a raw error.

Tests: each of the four states (valid, wrong account, unverified, invalid); return-to-invite
after sign-in.

Filed from the parity review of feature/parity-wip @ 14d7795 against interlinedlist.com (OpenAPI /api/openapi.json, 233 paths) and the public help centre.