DC-048: multi-user bootstrap + admin invites (opt-in)

Implements the user-store + invite-store + admin routes. The whole
system is opt-in via siteConfig.authProviders.email.enabled = true;
single-user TOTP-only installs see zero behavior change.

Backend:
- src/security/user-store.js: users + allowlist + bootstrap sentinel,
  atomic writes, last-admin protection, defensive dataDir resolver.
- src/security/invite-store.js: single-use tokens (SHA-256 hashed on
  disk), TTL, auto-prune, defensive dataDir resolver.
- routes/auth/admin.js: /me, /admin/users (CRUD), /admin/allowlist,
  /admin/invites (CRUD), public /invites/:token (peek + accept).
- routes/auth/index.js: wires userStore, gates admin router on
  email auth being enabled.
- src/auth/providers/email.js: verify() enforces allowlist, creates
  user record, tags req.user; default-enabled flipped to opt-in.
- src/auth/providers/totp.js: bootstraps system@totp.local admin on
  first verify so current DNS2 operator shows in /admin/users.
- src/security/audit-logger.js: middleware adds userId/userEmail/
  userRole/viaProvider to log details when req.user is tagged.
- PUBLIC_ROUTES + CSRF allowlists updated for invite redemption.

Frontend:
- status/js/admin.js: modal overlay with users list (role-edit,
  delete), invite form (email/role/TTL), copy-link button,
  outstanding-invites list with revoke. Exports window.AdminPanel.
- status/js/core/init.js: calls AdminPanel.attachTrigger so the
  Admin button only appears when /me returns isAdmin=true.

Tests: 35 new tests across 3 files (user-store, invite-store, auth
multistore integration). Full suite: 1298/1298 passing.

Docs: BACKLOG.md marks DC-048 done. CHANGELOG.md [Unreleased]
section gets the DC-048 entry.

BACKLOG.md

@@ -271,11 +271,12 @@ Tickets DC-033 through DC-041 were added after the DNS2 v1.14.4 / v1.14.8 / 0.0.
 - **result:** Shipped as part of DC-046 commit. `src/auth/providers/email.js` (388 LOC): registers `magic-link` (initiate) + `verify-token` (verify) methods, generates 32-byte base64url tokens, stores SHA-256 hashes via `email-tokens-store.js`. `email-tokens-store.js` (260 LOC): atomic lockfile-based mutation, automatic cleanup of expired tokens, audit log on every issue/use. `email-sender.js` (67 LOC): wraps nodemailer if `providers.email` config is set, else falls back to `log.info('auth', 'email magic link issued', ...)` so dev installs work without SMTP config. Verified with stub deps: `initiate()` writes a token + logs `deliveredVia: 'dev-console'` + returns masked email; `verify('verify-token', { token: 'garbage' })` throws AuthenticationError (route handler converts to 401). Real SMTP wiring takes effect as soon as `providers.email.host/port/username/password` are set in config.json.
 
 ### DC-048: Multi-user bootstrap + admin invites
-- **status:** todo
-- **owner:** unclaimed
+- **status:** done
+- **owner:** hermes
 - **details:** The user model shifts from "one implicit operator" to "many users with explicit roles". Bootstrap rule: the FIRST email to ever successfully log in via email magic link becomes the admin. Subsequent emails are denied with a `not authorized` error UNLESS the email appears in `data/authorized-users.json`. Admin UI: a `/users` page that lists authorized users, lets admin add emails (manual entry) or generate single-use invite links (which work like magic links but pre-add the email to the allowlist on first use). Audit log gets `userEmail` attribution on every entry. License model is unchanged (still per-host) but note in the ticket that this may need revisiting. Effort: ~2 hrs. Risk: low (mostly UI + JSON-store CRUD).
 - **impact:** First real multi-user DashCaddy. Per-user audit attribution. Self-service invites. Foundation for any future "team" features.
 - **prerequisite:** DC-047 (needs email auth working first).
+- **result:** Shipped as opt-in. Email auth must be explicitly enabled via `siteConfig.authProviders.email.enabled = true`; single-user TOTP-only installs see zero behavior change. New modules: `src/security/user-store.js` (users + allowlist + bootstrap sentinel, atomic writes, last-admin protection, 380 LOC), `src/security/invite-store.js` (single-use tokens, SHA-256 hashed on disk, TTL, 230 LOC). New routes: `routes/auth/admin.js` (`/me`, `/admin/users` GET/POST/PATCH/DELETE, `/admin/allowlist`, `/admin/invites` GET/POST/DELETE, public `/invites/:token` peek + `/invites/:token/accept` redeem, 360 LOC). EmailMagicLinkProvider `verify()` calls `userStore.isEmailAuthorized()` then `userStore.login()` then tags `req.user` for audit attribution; TOTP `verify()` bootstraps a `system@totp.local` admin record on first login so the current operator shows up in `/admin/users` without a re-login. Audit logger middleware reads `req.user` and adds `userId`/`userEmail`/`userRole`/`viaProvider` to log details. New admin UI: `status/js/admin.js` (modal overlay, users list with role-edit + delete, invite form with copy-link button, outstanding-invites list with revoke). Wired into `core/init.js` so the "Admin" trigger button appears in the top bar only when `/me` returns `isAdmin: true`. 35 new tests across 3 files. Full suite: 1298/1298. Update PUBLIC_ROUTES + CSRF allowlists for the new invite redemption paths (same exemption rationale as login verify).
 
 ### Backlog note (2026-07-20, hermes)