feat(invitations): guide invited users without an account through sign-up

Clicking an invitation link while signed out dropped the visitor on a bare login form,
even though most invitees have no account yet and nothing on screen told them to create one.

Signed-out visitors now get the invitation itself: who invited them, which workspace/project,
which role, and which address it was sent to. The primary call to action follows whether an
account already exists for that address — "Create your account" when it does not, "Sign in to
accept" when it does.

The sign-up path carries the invitation forward, so a new account lands back on the invitation
and from there on the shared workspace/project instead of the onboarding wizard:
- the register link passes invitationToken, the invited email and a callbackUrl
- the register form locks the email to the invited address and shows what is being joined
- the verification email round-trips the destination through a sanitized `next` parameter
- login and verify-email keep the pending destination in their sign-in links

Signing in with a different address than the one invited now explains the mismatch instead of
silently redirecting to the dashboard.

Callback sanitization moves to lib/safe-redirect.ts so login, register, verify-email and the
verification route share one open-redirect guard.

lib/invitations.ts

@@ -221,6 +221,64 @@ export async function createOrRefreshInvitation(params: {
   throw new Error('Failed to create invitation after retrying');
 }
 
+export interface InvitationPreview {
+  email: string;
+  role: InvitationRole;
+  roleLabel: string;
+  scope: InvitationScope;
+  scopeLabel: string;
+  status: InvitationStatus;
+  /** PENDING but past its expiry — the DB row is only flipped to EXPIRED on acceptance. */
+  isExpired: boolean;
+  inviterName: string;
+  targetName: string | null;
+  /** Whether an account already exists for the invited address. */
+  hasAccount: boolean;
+}
+
+/**
+ * Public-facing summary of an invitation, safe to render to a signed-out visitor:
+ * the token itself is the secret, and everything here was already in the email we sent
+ * to that address.
+ */
+export async function getInvitationPreviewByToken(
+  token: string
+): Promise<InvitationPreview | null> {
+  const invitation = await db.invitation.findUnique({
+    where: { token },
+    select: {
+      email: true,
+      role: true,
+      scope: true,
+      status: true,
+      expiresAt: true,
+      invitedBy: { select: { name: true } },
+      workspace: { select: { name: true } },
+      project: { select: { name: true } },
+    },
+  });
+
+  if (!invitation) return null;
+
+  const existingUser = await db.user.findUnique({
+    where: { email: invitation.email },
+    select: { id: true },
+  });
+
+  return {
+    email: invitation.email,
+    role: invitation.role,
+    roleLabel: roleLabel(invitation.role),
+    scope: invitation.scope,
+    scopeLabel: scopeLabel(invitation.scope),
+    status: invitation.status,
+    isExpired: invitation.expiresAt <= new Date(),
+    inviterName: invitation.invitedBy?.name?.trim() || 'A team member',
+    targetName: invitation.workspace?.name ?? invitation.project?.name ?? null,
+    hasAccount: Boolean(existingUser),
+  };
+}
+
 export async function getValidInvitationByToken(token: string) {
   const now = new Date();
   return db.invitation.findFirst({