DC-048: multi-user bootstrap + admin invites (opt-in)

Implements the user-store + invite-store + admin routes. The whole
system is opt-in via siteConfig.authProviders.email.enabled = true;
single-user TOTP-only installs see zero behavior change.

Backend:
- src/security/user-store.js: users + allowlist + bootstrap sentinel,
  atomic writes, last-admin protection, defensive dataDir resolver.
- src/security/invite-store.js: single-use tokens (SHA-256 hashed on
  disk), TTL, auto-prune, defensive dataDir resolver.
- routes/auth/admin.js: /me, /admin/users (CRUD), /admin/allowlist,
  /admin/invites (CRUD), public /invites/:token (peek + accept).
- routes/auth/index.js: wires userStore, gates admin router on
  email auth being enabled.
- src/auth/providers/email.js: verify() enforces allowlist, creates
  user record, tags req.user; default-enabled flipped to opt-in.
- src/auth/providers/totp.js: bootstraps system@totp.local admin on
  first verify so current DNS2 operator shows in /admin/users.
- src/security/audit-logger.js: middleware adds userId/userEmail/
  userRole/viaProvider to log details when req.user is tagged.
- PUBLIC_ROUTES + CSRF allowlists updated for invite redemption.

Frontend:
- status/js/admin.js: modal overlay with users list (role-edit,
  delete), invite form (email/role/TTL), copy-link button,
  outstanding-invites list with revoke. Exports window.AdminPanel.
- status/js/core/init.js: calls AdminPanel.attachTrigger so the
  Admin button only appears when /me returns isAdmin=true.

Tests: 35 new tests across 3 files (user-store, invite-store, auth
multistore integration). Full suite: 1298/1298 passing.

Docs: BACKLOG.md marks DC-048 done. CHANGELOG.md [Unreleased]
section gets the DC-048 entry.

dashcaddy-api/src/auth/providers/index.js

@@ -42,6 +42,8 @@ function createAuthProviderRegistry(deps, config) {
     ...deps,
     config: deps.config.totp, // the existing totpConfig object from app.js
     saveProviderConfig: deps.saveTotpConfig, // existing helper
+    // DC-048: user store for bootstrap + audit attribution on TOTP logins.
+    userStore: deps.userStore || null,
   });
   providers.set('totp', totpProvider);
 
@@ -56,9 +58,9 @@ function createAuthProviderRegistry(deps, config) {
     saveProviderConfig: deps.saveProviderConfig || (async () => {}),
     emailConfig: deps.emailConfig || null,
     siteConfig: deps.siteConfig || {},
-    // DC-048 hook: today every email is authorized. Once multi-user ships,
-    // this is replaced with a real allowlist check.
-    authorizedEmails: deps.authorizedEmails || (() => true),
+    // DC-048: real authorization check via the user store. Without it,
+    // every email is allowed (legacy single-user behavior).
+    userStore: deps.userStore || null,
   }));
 
   // Future: OIDC, SAML, passkeys — each gated on config.authProviders