feat(landing): bridge the invite, plugin-install and snippet-install routes - #14

Mirrors the three new confirm routes from the client's `src/services/deepLinkUrl.ts` so their `https` form resolves on the `/open` hop instead of rendering the invalid state. Without this, those links die silently on the web bridge.

• `invite` validates the handle against the server's `validate_custom_handle` rule (3–30 chars, lowercase/digits/`-`/`_`, no edge separator), stripping one optional leading `@` and lowercasing first — matching the client token for token.
• `plugin-install` validates the plugin id against the client's `isValidPluginId`. The leading-alphanumeric class is load-bearing: on the client that id becomes a directory name, and it is what keeps `meta` and `..` unclaimable. `src` is a catalogue id, never a URL, so only its length is checked here.
• `snippet-install` validates presence and length only — the catalogue is fetched client-side.

No new route produces a paste-able code; `readFragment` still gates that on `join` alone. The parser itself is unchanged — these are entries in `ROUTE_VALIDATORS`, not a fork.

Pairs with VoltiusApp/voltius#(client PR).