refactor: remove Dex local-password invite provisioning (ADR-019)

Authentik owns invites now (infra ADR-0001). Delete adapters/dex, the
/invite set-password UI, the tapir invite CLI, the InvitationStore/
DexPasswordCreator ports + App wiring, the invite Templ pages, and the
invite Taskfile target. New users are invited via Authentik, log in via
OIDC, and hit the existing /register gate. invitations table (mig 009)
left in place (append-only; harmless). task check green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/web/export_test.go

@@ -1,14 +0,0 @@
-package web
-
-import "net/http"
-
-// Test-only handles to the unexported invite handlers so the external web_test
-// package can mount them on an httptest mux (and get PathValue routing) without
-// standing up the full Router + auth stack. export_test.go compiles only under
-// `go test`, so these never widen the package's real API.
-func (a *App) HandleInviteFormForTest(w http.ResponseWriter, r *http.Request) {
-	a.handleInviteForm(w, r)
-}
-func (a *App) HandleInviteSubmitForTest(w http.ResponseWriter, r *http.Request) {
-	a.handleInviteSubmit(w, r)
-}