Phase 5: Invite and password flows
- invite token model and service
- forgot/reset password flows
- accept invite flow
- must_change_password enforcement
- invite generation from user list and user create form