refactor: remove Dex local-password invite provisioning (ADR-019)

Authentik owns invites now (infra ADR-0001). Delete adapters/dex, the
/invite set-password UI, the tapir invite CLI, the InvitationStore/
DexPasswordCreator ports + App wiring, the invite Templ pages, and the
invite Taskfile target. New users are invited via Authentik, log in via
OIDC, and hit the existing /register gate. invitations table (mig 009)
left in place (append-only; harmless). task check green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

cmd/tapir/main.go

@@ -22,7 +22,6 @@ import (
 	"os/signal"
 	"time"
 
-	"gitea.d-ma.be/mathias/tapir/internal/adapters/dex"
 	"gitea.d-ma.be/mathias/tapir/internal/adapters/secrets"
 	"gitea.d-ma.be/mathias/tapir/internal/adapters/store"
 	"gitea.d-ma.be/mathias/tapir/internal/adapters/youtube"
@@ -55,8 +54,6 @@ func main() {
 		err = cmdRun(ctx, log)
 	case "serve":
 		err = cmdServe(ctx, log)
-	case "invite":
-		err = cmdInvite(ctx, os.Args[2:])
 	case "report":
 		err = runReport(ctx, os.Args[2:])
 	default:
@@ -77,7 +74,6 @@ usage:
   tapir auth              one-time: authorize YouTube and store a refresh token
   tapir run               detect new videos, summarize, deliver to your store
   tapir serve             run the web UI (read summaries, record watch/skip/save)
-  tapir invite <email>    mint an invitation link for a new user (host-side)
   tapir list [-limit N]   list stored summaries, recent first
   tapir show <video-id>   show one summary in full
   tapir report            Stage-0 usage gate: per-user distinct active weeks
@@ -197,19 +193,9 @@ func cmdServe(ctx context.Context, log *slog.Logger) error {
 	secretStore := secrets.NewFileStore(cfg.SecretsFile)
 	app := &web.App{Store: st, Identity: st, Auth: authn, Secrets: secretStore, Log: log}
 
-	// Email-invite onboarding (public /invite/{token}). The store validates and
-	// consumes tokens; the Dex client creates the local-password account. In-cluster
-	// the SA token mount is present and account creation works; off-cluster (dev) it
-	// is nil and the submit handler degrades to a clear "deployed-only" message.
-	app.Invitations = st
-	if dexClient, err := dex.NewPasswordClient(); err == nil {
-		app.Dex = dexClient
-		log.Info("invite account creation enabled (in-cluster dex password client)")
-	} else if errors.Is(err, dex.ErrNotInCluster) {
-		log.Warn("invite account creation disabled: not in-cluster — /invite is deployed-only")
-	} else {
-		return fmt.Errorf("dex password client: %w", err)
-	}
+	// User onboarding is handled by the IdP (Authentik invite flow), not Tapir —
+	// the Dex local-password provisioning path was removed (ADR-019). An
+	// authenticated subject with no Tapir user is routed to /register.
 
 	// Web-initiated YouTube connect (ADR-006). Mounted only when the OAuth client
 	// credentials are present; the refresh token persists through the SecretStore