feat: unified invite flow — knock any Voltius user (client) - #122

…r client calls

…ssion name once

… in getUserPublicKey

…-data blob

…on-rule empty state

… in the People tab

…ver the 3-tab matrix

Review findings on the People-tab restructure:
- PeopleTab folded a failed allTeammates() fetch into the same state as an
  empty roster; give it its own inviteLoadFailed banner, same as the deleted
  InvitePeopleSection had.
- Cover the teams/business and pro-with-qualifying-vault branches of the tab
  availability matrix, which no existing test reached.
- Replace the Tailwind arbitrary animation-duration override (ambiguous
  against the animate-fadeIn/fadeOut shorthand tokens) with an inline style
  that always wins the cascade.
- Move the reduced-motion keyframe override next to the keyframes it guards.

… block

…invites

…tier flash, guard the stranger-invites toggle

The 500-from-key-lookup test asserted on the literal i18n key, which
worked only while the key had no translated copy. The strings task
added real English text for it, so i18n.t() now resolves the key and
the assertion compared against the wrong string. Assert on the status
code instead so this survives future copy changes.

…lied name

The stranger knock built its inviter from a participant's display_name, which
originates in the sender's own WebSocket query string. A sender could connect to
their own session as "Voltius Support" and put that name above a Join button
granting terminal access — walking straight past the reserved-handle list, which
refuses @voltius-support at claim time but never saw this surface.

The entry now renders @{invited_by_handle}, the value the server resolves from
its own users table, and falls back to "Someone" when it is absent (an older
server, or a race). Never to display_name: that is the hole. The teammate
sessionInvite and broadcast sessionShared entries are untouched.

joinSharedSession froze the tab title at the redacted placeholder it had at
knock time. The server un-redacts on admission, but nothing renamed a
multiplayer tab afterwards, so a joined knock read "Shared terminal" forever —
against the spec's own live-run criterion that Join reveals the name. Refetch
once after the join resolves and patch the session's connectionName.

Recent rows were built with teamIds: [], and memberHasAccess tests teamIds
against the session's vaults first. Under the "Recent wins over Your teams"
dedupe a teammate in Recent therefore rendered as invitable in a session scoped
to their own vault; tapping issued a real grant, seatUsage counted it, and a Pro
host at cap 1 lost the seat they meant for someone else. Merge the matching
teammate entry in — the person still appears once, under Recent.

replaceAll is the path that takes foreign data — the sync blob and the import UI
— and it neither checked its input was an array nor stripped unknown fields, so
the "Recent never persists a public key" invariant held only on the one path
that never sees untrusted input.

The last hand-rolled copy of that shape; it stayed out only because its error
message interpolates a status. Give authedCall an optional interpolation
argument instead of keeping a third copy of the call sequence.

A single refetch after Join raced the un-redaction and lost it on every
attempt of a live run, so a joined knock read "Shared Terminal" forever.
Poll on a bounded backoff instead, detached from the join so the inbox
entry does not sit in its acting state.

replaceAll set the list without recentUpdatedAt, so a device that
received Recent over the sync blob kept the epoch and lost the next
last-write-wins merge. It now stamps like remember/forget, which under
the remote-apply guard adopts the remote timestamp and pushes nothing.

A standing invite held a guest seat until the session ended with no way
to take it back, and rendered as "Has access" — indistinguishable from
someone already in the room. The row now says Invited and carries a
Withdraw action that calls the un-invite endpoint and refetches, so the
seat frees. memberHasAccess keeps counting pending invites for the cap;
the new memberHasLiveAccess answers the row's question.

…r copy at it

B4's account-menu surface was never built, and the free-tier note offered
the user's email as the way to be reached — the opposite of why every
account gets a handle. Copy-with-feedback is now one hook shared by both
surfaces.