Send or resend an invitation to a user

Creates a new invitation for the selected user — the "Resend invite" action shown for INVITED members in the Users page row menus and in the detail header. A fresh invitation email containing the getting-started guide, the console URL and a sign-in link is dispatched to the user's registered address; any previously issued invite link for the user is superseded. An optional personal message is prepended to the email. The invite becomes discoverable on the user record and the member remains INVITED until they accept. Validation: userId must exist and be visible in scopeId (404 via ErrNotFound); the user must currently be in INVITED state — resending to an ACTIVE or INACTIVE member is rejected with 409 CONFLICT; personalMessage, when provided, is length-bounded (422 VALIDATION_FAILED on overflow); the caller must hold owner|admin on the scope. Async & state: Asynchronous — returns 202 with the Invite resource in its transitional PENDING state; email dispatch moves it to terminal SENT (or FAILED on delivery error), and acceptance later transitions it to ACCEPTED while flipping the user to ACTIVE. Progress is pushed via resource.updated SSE frames (kind iam.userInvite, patch on status; the parent iam.user frame patches status on acceptance). Errors: 401 unauthenticated; 403 when the caller lacks owner|admin on the scope; 404 when scopeId/userId is unknown; 409 when the user is not in an invitable state; 422 on body validation failure (a personalMessage over 500 characters or carrying a link); 429 when invitation sending is rate-limited (details.reason: INVITE_RESEND_COOLDOWN within 60 s of the last invite, INVITE_USER_DAILY_LIMIT after 5 in 24 h, INVITE_TENANT_DAILY_LIMIT for the tenant's daily budget); 500 on dispatch failure. Idempotency/Concurrency: Idempotency-Key is required; replaying the same key returns the originally created invite without sending a duplicate email — duplicate invitations would be harmful, so retries are made safe.