refactor: remove Dex local-password invite provisioning (ADR-019)

Authentik owns invites now (infra ADR-0001). Delete adapters/dex, the
/invite set-password UI, the tapir invite CLI, the InvitationStore/
DexPasswordCreator ports + App wiring, the invite Templ pages, and the
invite Taskfile target. New users are invited via Authentik, log in via
OIDC, and hit the existing /register gate. invitations table (mig 009)
left in place (append-only; harmless). task check green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/web/handlers.go

@@ -80,14 +80,6 @@ type App struct {
 	// Processing tracks in-flight immediate summarizations so the status endpoint
 	// shows the animation until the summary lands. The zero value is ready to use.
 	Processing ProcessingSet
-	// Invitations validates and consumes email-invite tokens for the public
-	// /invite/{token} flow. Nil = the invite routes report "invalid" (the flow is
-	// effectively off). *store.Store satisfies it.
-	Invitations InvitationStore
-	// Dex creates the Dex local-password account when an invite is claimed. Nil =
-	// not in-cluster (dev): the submit handler degrades to a clear "deployed-only"
-	// message instead of creating an account. *dex.PasswordClient satisfies it.
-	Dex DexPasswordCreator
 }
 
 func (a *App) logger() *slog.Logger {
@@ -107,11 +99,6 @@ func (a *App) Router() http.Handler {
 	root.Handle("GET /static/", staticHandler())
 	root.Handle("/auth/", a.Auth.Routes())
 
-	// Email invitation claim (public — the visitor has no Dex session yet, so this
-	// sits OUTSIDE Auth.Middleware). The token in the path is the capability.
-	root.HandleFunc("GET /invite/{token}", a.handleInviteForm)
-	root.HandleFunc("POST /invite/{token}", a.handleInviteSubmit)
-
 	app := http.NewServeMux()
 	app.HandleFunc("GET /{$}", a.handleList)
 	app.HandleFunc("GET /v/{videoId}", a.handleDetail)