Build user invitations and operator access administration

Build one complete internal operator journey: list/detail reusable realm accounts, invite via expiring single-use password setup, assign/revoke organization memberships and existing project roles/access, disable accounts. Keep detailed Kaukus business roles and customer provisioning outside this slice. Reuse BrowserState, session-backed authority, shared Maud UI and curated atomic history/outbox patterns. Security/decisions: serialize identity access mutations per realm and prevent removing the last active credential-bearing administrator; revalidate operator authority inside write transactions. Invitation setup is anonymous-session CSRF/origin protected, bounded and single-use under concurrent redemption. No credential/invitation secret in audit/outbox/logs. Local Mailpit-only durable outbox delivery with stable retry links, no real notification credentials, explicit worker and synthetic fixtures only. Preserve existing services/ports; no commits requested. Acceptance: create second operator through UI, receive local email, establish own password, grant admin role and revoke it; existing session loses protected access. Reuse one account across organizations. Tests cover isolation, unauthorized/CSRF access, rollback/audit field selection, expiry/replay/concurrency, last-admin safeguards and delivery retry behavior. Run formatting, strict Clippy, ordinary and dedicated synthetic PostgreSQL suites, frontend/browser matrix and evidence-backed Chrome journey. Document local setup and limitations. Implemented and verified on feature/add-user-access-administration. Migration 0004 adds memberships, curated invitation lifecycle history, anonymous digest handoff and delivery metadata; narrow security-definer mutation/redemption functions preserve runtime read-only identity tables. User feature separates domain, DB records, HTTP input and page views; BrowserState/session context and shared Maud components are reused. Invitation secrets use a private local HMAC delivery key, identifier-only outbox and stable retry links; token GET redirects asset-free to a clean URL before native CSRF-protected setup. Final validation passed: cargo fmt --check; strict workspace/all-target/all-feature Clippy; ordinary workspace/all-feature tests; python3 dev/run.py test (65 non-browser Rust tests, five tooling tests and asset gates); full browser gate (eight asset/theme/JS preview cases plus four real-Chrome operator journeys with actual Mailpit email, own-password establishment, membership reuse, grant, live-session revocation and disable). Seven new PostgreSQL tests cover pagination/duplicate rollback, authority/isolation/stale versions, last usable admin including pending-account exclusion and concurrent self-disable, setup expiry/revocation/replay/concurrent redemption, atomic rollback/audit fields and SMTP retry/backoff/stable links. Light/dark screenshots inspected; browser logs verified free of test password, delivery key and raw setup query. Whitespace/private-content checks pass. Disk-full interruption was resolved by deleting disposable local incremental build artifacts; fixture recovered and validation reran successfully. Documentation: docs/user-administration.md plus README/authentication/frontend updates. Limits explicit: local-only mail, at-least-once duplicate delivery possible, key retention required, choices first100/recent50 history, no reenable/delete/profile/recovery/project configuration/customer API. Final parallel static review found no verified findings but remained partial: security/correctness did not inspect the users/browser.rs diff, and reviewers did not execute tests. Preserve that limitation; validation is independently established by actual gates, not review approval. Owned test server/worker processes stopped. All work remains uncommitted; no production changes.