fix(web): correct stale welcome-page invite copy

The landing page promised "if you have an invite link, it will set up your
account automatically" — but invites moved to Authentik (ADR-019); Tapir no
longer handles invite links and "Get Started" goes straight to OIDC. Replace
with honest "invite-only — if you've been invited, sign in" and set the
gradual-fill expectation before the login wall (UX review A5). Test pins the
stale phrase out.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/web/welcome_test.go

@@ -53,6 +53,11 @@ func TestWelcomeLoggedOut(t *testing.T) {
 	require.Contains(t, html, "Get Started", "logged-out CTA present")
 	require.Contains(t, html, `href="/auth/login"`, "CTA links into the Dex flow")
 	require.NotContains(t, html, "Go to my Tapir", "no logged-in controls")
+	// Invites are owned by Authentik now (ADR-019); Tapir no longer handles
+	// invite links. The old "invite link will set up your account automatically"
+	// promise is stale and misleading — it must be gone.
+	require.NotContains(t, html, "invite link", "stale Authentik-superseded invite copy must be removed")
+	require.Contains(t, html, "invite-only", "honest invite-only framing present")
 }
 
 func TestWelcomeLoggedIn(t *testing.T) {