DC-048: multi-user bootstrap + admin invites (opt-in)

Implements the user-store + invite-store + admin routes. The whole
system is opt-in via siteConfig.authProviders.email.enabled = true;
single-user TOTP-only installs see zero behavior change.

Backend:
- src/security/user-store.js: users + allowlist + bootstrap sentinel,
  atomic writes, last-admin protection, defensive dataDir resolver.
- src/security/invite-store.js: single-use tokens (SHA-256 hashed on
  disk), TTL, auto-prune, defensive dataDir resolver.
- routes/auth/admin.js: /me, /admin/users (CRUD), /admin/allowlist,
  /admin/invites (CRUD), public /invites/:token (peek + accept).
- routes/auth/index.js: wires userStore, gates admin router on
  email auth being enabled.
- src/auth/providers/email.js: verify() enforces allowlist, creates
  user record, tags req.user; default-enabled flipped to opt-in.
- src/auth/providers/totp.js: bootstraps system@totp.local admin on
  first verify so current DNS2 operator shows in /admin/users.
- src/security/audit-logger.js: middleware adds userId/userEmail/
  userRole/viaProvider to log details when req.user is tagged.
- PUBLIC_ROUTES + CSRF allowlists updated for invite redemption.

Frontend:
- status/js/admin.js: modal overlay with users list (role-edit,
  delete), invite form (email/role/TTL), copy-link button,
  outstanding-invites list with revoke. Exports window.AdminPanel.
- status/js/core/init.js: calls AdminPanel.attachTrigger so the
  Admin button only appears when /me returns isAdmin=true.

Tests: 35 new tests across 3 files (user-store, invite-store, auth
multistore integration). Full suite: 1298/1298 passing.

Docs: BACKLOG.md marks DC-048 done. CHANGELOG.md [Unreleased]
section gets the DC-048 entry.

dashcaddy-api/src/utilities/middleware.js

@@ -335,6 +335,14 @@ module.exports = function configureMiddleware(app, {
     { path: '/api/v1/auth/login/:provider/verify',   exact: true,  method: 'POST' },
     { path: '/api/v1/auth/login/recovery-info',     exact: true,  method: 'GET' },
     { path: '/api/v1/auth/disable/:provider',       exact: true,  method: 'POST' },
+    // DC-048: invite redemption is PUBLIC (recipient comes from an email
+    // link with no session cookie). The peek route is also public so the
+    // UI can show "this invite is for X, expires Y" before clicking.
+    { path: '/api/v1/auth/invites/:token',            exact: true,  method: 'GET' },
+    { path: '/api/v1/auth/invites/:token/accept',     exact: true,  method: 'POST' },
+    // /me and /admin/* require authentication — NOT public. Listed here
+    // only to document them; absence from PUBLIC_ROUTES means they go
+    // through the normal auth gate. CSRF applies to writes as usual.
     { path: '/api/v1/services',          exact: true,  method: 'GET' },
     { path: '/api/v1/ca/info',           exact: true,  method: 'GET' },
     { path: '/api/v1/ca/root.crt',       exact: true,  method: 'GET' },