fix: close DQ-001 + A4b, and gate SEC-3 from recurring [qa twin]
- fix(security): gate every /api/admin route on having a decided authz posture
- fix(admin): refuse to send an invite a Tapestry user cannot complete (DQ-001)
- fix(admin): stop the server accepting org roles the UI never offers (A4b)
- Merge pull request #410 from tpromni/fix/admin-invite-guard-surface-coverage-qa
Source: tpromni/coach-pulse-admin-ui → qa