[glm-grade=B] fix(auth): DC-089 mask invite/user emails in server logs

Two log sites in routes/auth/admin.js wrote raw email PII to the server
log: the SMTP-unconfigured 'auth-invite-send' warn and the 'invite
accepted, user created' info. Both now route through
AuthProvider.maskEmail() with a '[unmaskable-email]' sentinel fallback
(never the raw address). Two regression tests assert the raw address is
absent from log meta and the masked form present. Response contract
unchanged (full email still returned to the authenticated admin).

Judge: GLM-5.3 cold read (deleg_f0896de3), grade B / ship / zero
blockers; polish notes folded in. Verdict URN:
urn:ump:jd2htpwq76ni6bapj3vxjpvypfdnoc4argqbzpcerutmh7u5khea
Full suite: 2610/2610 (109 suites).

dashcaddy-api/routes/auth/admin.js

@@ -29,6 +29,7 @@ const platformPaths = require('../../platform-paths');
 const { createUserStore } = require('../../src/security/user-store');
 const { createInviteStore } = require('../../src/security/invite-store');
 const emailSender = require('../../src/auth/providers/email-sender');
+const AuthProvider = require('../../src/auth/providers/base');
 const { ValidationError, NotFoundError, ForbiddenError, PaymentRequiredError } = require('../../src/utilities/errors');
 const { ok, successMessage } = require('../../src/utils/responses');
 
@@ -254,7 +255,7 @@ module.exports = function({ asyncHandler, errorResponse, log, session, dataDir }
           // server log on every unconfigured-install invite.
           log.warn && log.warn('auth-invite-send',
             'invite send skipped: SMTP not configured (operator opted in)',
-            { inviteId: issued.id, email: issued.email });
+            { inviteId: issued.id, email: AuthProvider.maskEmail(issued.email) || '[unmaskable-email]' });
           deliveredVia = 'failed';
         }
       } catch (sendErr) {
@@ -369,7 +370,7 @@ module.exports = function({ asyncHandler, errorResponse, log, session, dataDir }
 
     log.info && log.info('auth', 'invite accepted, user created', {
       userId: userResult.user.id,
-      email: userResult.user.email,
+      email: AuthProvider.maskEmail(userResult.user.email) || '[unmaskable-email]',
       role: userResult.user.role,
       inviteId: invite.id,
     });