feat: signup toggle, invite links, admin-created users

- New invites table: token-gated signup, optional email lock,
  role/tier override, single-use, expiry.
- SIGNUPS_DISABLED site setting toggle at /admin/settings.
- databaseHooks.user.create gate in auth/server.ts blocks new account
  creation (email + Google OAuth) when disabled unless a valid invite
  cookie is present; applies invite role/tier and marks it consumed.
- /admin/invites: create/list/revoke shareable invite links.
- /admin/users: "Create user" dialog — admin sets email/role/tier,
  account is pre-verified, user gets a set-password email (admin
  never sees a password).
- Signup page reads ?invite=, validates via public
  /api/v1/invites/[token], locks the form when signups are closed
  and no valid invite is present.
- proxy.ts: allowlist /api/v1/invites/ for anonymous invite checks.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/admin/invites/page.tsx

@@ -0,0 +1,34 @@
+import type { Metadata } from "next";
+import { listInvites } from "@/lib/invites";
+import { InvitesManager } from "@/components/admin/invites-manager";
+
+export const metadata: Metadata = { title: "Invites – Admin" };
+
+export default async function AdminInvitesPage() {
+  const invites = await listInvites();
+  const appUrl = process.env["BETTER_AUTH_URL"] ?? "http://localhost:3000";
+
+  return (
+    <div className="space-y-6">
+      <div>
+        <h1 className="text-2xl font-bold tracking-tight">Invites</h1>
+        <p className="text-muted-foreground text-sm mt-1">
+          Generate shareable signup links. Required when signups are disabled in{" "}
+          <span className="font-medium">Settings</span>.
+        </p>
+      </div>
+      <InvitesManager
+        invites={invites.map((i) => ({
+          id: i.id,
+          token: i.token,
+          email: i.email,
+          role: i.role,
+          tier: i.tier,
+          createdAt: i.createdAt.toISOString(),
+          expiresAt: i.expiresAt?.toISOString() ?? null,
+        }))}
+        appUrl={appUrl}
+      />
+    </div>
+  );
+}

apps/web/app/admin/layout.tsx

@@ -3,12 +3,13 @@ import { headers } from "next/headers";
 import { auth } from "@/lib/auth/server";
 import { db, users, eq } from "@epicure/db";
 import Link from "next/link";
-import { Shield, Users, BookOpen, Settings, BarChart3, ClipboardList, HardDrive, Bot, ArrowLeft, Gauge } from "lucide-react";
+import { Shield, Users, BookOpen, Settings, BarChart3, ClipboardList, HardDrive, Bot, ArrowLeft, Gauge, Mail } from "lucide-react";
 import { cn } from "@/lib/utils";
 
 const adminNav = [
   { href: "/admin", label: "Overview", icon: BarChart3 },
   { href: "/admin/users", label: "Users", icon: Users },
+  { href: "/admin/invites", label: "Invites", icon: Mail },
   { href: "/admin/recipes", label: "Recipes", icon: BookOpen },
   { href: "/admin/tiers", label: "Tier Limits", icon: Gauge },
   { href: "/admin/audit-logs", label: "Audit Logs", icon: ClipboardList },

apps/web/app/admin/settings/page.tsx

@@ -1,6 +1,7 @@
 import type { Metadata } from "next";
-import { getAllSiteSettings } from "@/lib/site-settings";
+import { getAllSiteSettings, isSignupsDisabled } from "@/lib/site-settings";
 import { AdminSettingsForm } from "@/components/admin/admin-settings-form";
+import { SignupsToggle } from "@/components/admin/signups-toggle";
 
 export const metadata: Metadata = { title: "Site Settings – Admin" };
 
@@ -24,6 +25,7 @@ const SETTING_GROUPS = [
 
 export default async function AdminSettingsPage() {
   const settings = await getAllSiteSettings();
+  const signupsDisabled = await isSignupsDisabled();
 
   return (
     <div className="space-y-8">
@@ -35,6 +37,8 @@ export default async function AdminSettingsPage() {
         </p>
       </div>
 
+      <SignupsToggle initialDisabled={signupsDisabled} />
+
       {SETTING_GROUPS.map((group) => (
         <AdminSettingsForm key={group.title} group={group} settings={settings} />
       ))}

apps/web/app/admin/users/page.tsx

@@ -4,6 +4,7 @@ import { users } from "@epicure/db";
 import { desc } from "@epicure/db";
 import { Badge } from "@/components/ui/badge";
 import { Avatar, AvatarFallback, AvatarImage } from "@/components/ui/avatar";
+import { CreateUserDialog } from "@/components/admin/create-user-dialog";
 import Link from "next/link";
 
 export const metadata: Metadata = { title: "User Management" };
@@ -28,7 +29,10 @@ export default async function AdminUsersPage() {
 
   return (
     <div className="space-y-6">
-      <h1 className="text-2xl font-bold tracking-tight">Users</h1>
+      <div className="flex items-center justify-between">
+        <h1 className="text-2xl font-bold tracking-tight">Users</h1>
+        <CreateUserDialog />
+      </div>
       <div className="rounded-md border">
         <table className="w-full text-sm">
           <thead className="border-b bg-muted/50">