Authentication

Registration requires an email-bound invitation and later administrator approval. Sessions use HttpOnly SameSite cookies; mutations require CSRF and same-origin protection.