fix: close DQ-001 + A4b, and gate SEC-3 from recurring
- fix(security): gate every /api/admin route on having a decided authz posture
- fix(admin): refuse to send an invite a Tapestry user cannot complete (DQ-001)
- fix(admin): stop the server accepting org roles the UI never offers (A4b)
- Merge pull request #409 from tpromni/fix/admin-invite-guard-surface-coverage
Source: tpromni/coach-pulse-admin-ui → dev