Let a team be joined only by somebody who is already here

An invitation decided access from an assertion about an address. Everything else
in this model decides it from something a person did — an admin naming an
account, a key holder wrapping a vault key to a key they verified — and this was
the one place a token's email claim was the thing that let somebody in.

It was guarded as tightly as that can be guarded: the claim was refused outright
on an unverified or absent `email_verified`, with no setting to relax it. But the
guard and the risk were the same shape. The whole defence was one boolean sent by
a system the deployment does not control.

So `POST /teams/{id}/members` is the only way in, and an address with no account
is refused with `no-such-account` — which is now the end of the road rather than
the signal to invite. Both clients say the remedy: that person signs in here
once, which is what creates the account, and then they can be added. The desktop
leaves the address in the box, because a message telling you to come back later
is one you act on later.

Gone with it: the `team_invitation` table, the claim hook in the sign-in path,
and `Oidc:EmailVerifiedClaim`, which that hook was the only reader of. Nothing in
the server now reads the email claim to decide anything.

Pending invitations are dropped rather than converted. Converting one would mean
creating a membership because an address matched, which is the property being
removed — and an invitation to an address that did have an account here had
already been claimed by the hourly sweep, so what is left is offers to people who
never arrived.

Two tests carry the property rather than the feature: the endpoint inventory
asserts the three routes are absent, and the API suite adds an address that has
no account, watches the refusal, then signs that address in and checks it joined
nothing. Without the second half, a server that merely renamed the deferred path
would pass.

src/DodoSSH.Api/Setup/DodoOptions.cs

@@ -62,28 +62,15 @@ public sealed class OidcOptions
     public string EmailClaim { get; set; } = "email";
 
     /// <summary>Claim type holding the user's display name.</summary>
-    public string NameClaim { get; set; } = "name";
-
-    /// <summary>
-    /// Claim type asserting that the provider has verified the user's email.
-    /// </summary>
     /// <remarks>
-    /// <para>
-    /// Read for exactly one purpose: deciding whether a pending team invitation addressed to that
-    /// email may be claimed. Nothing else in this server trusts the email claim for anything, and
-    /// <see cref="AllowEmailLinking"/> records why — a token from any configured provider carrying a
-    /// victim's address must not confer access to anything of theirs. An invitation is access, so it
-    /// needs the same bar.
-    /// </para>
-    /// <para>
-    /// <b>Absence is a refusal, not a default.</b> A provider that does not send this claim leaves
-    /// every invitation pending for ever, which is visible on the teams screen and diagnosable in the
-    /// log. There is deliberately no option to trust an unverified address instead: a flag that exists
-    /// is a flag somebody turns on for the afternoon their provider is misconfigured, and this is the
-    /// one it must not be possible to turn on.
-    /// </para>
+    /// The email and the display name are read for display and for the directory's address lookup, and
+    /// for nothing that decides access. There was an <c>EmailVerifiedClaim</c> beside these, read by
+    /// exactly one feature — claiming a team invitation addressed to that address — and it went with
+    /// the invitations. Nothing in this server now trusts the email claim to grant anything, which is
+    /// the property <see cref="AllowEmailLinking"/> spends its whole doc comment defending; re-adding a
+    /// setting here would be the first step back towards a token's address being a way in.
     /// </remarks>
-    public string EmailVerifiedClaim { get; set; } = "email_verified";
+    public string NameClaim { get; set; } = "name";
 }
 
 /// <summary>Schema management.</summary>

src/DodoSSH.Api/Setup/EndpointRegistration.cs

@@ -54,9 +54,6 @@ internal static class EndpointRegistration
             typeof(AddTeamMemberEndpoint),
             typeof(ChangeTeamMemberRoleEndpoint),
             typeof(RemoveTeamMemberEndpoint),
-            typeof(ListTeamInvitationsEndpoint),
-            typeof(CreateTeamInvitationEndpoint),
-            typeof(RevokeTeamInvitationEndpoint),
             typeof(CreateTeamVaultEndpoint),
             typeof(RenameVaultEndpoint),
             typeof(DeleteVaultEndpoint),