Function accept_invitation 

pub async fn accept_invitation(
    req: HttpRequest,
    state: State<AppState>,
    token: Path<String>,
    body: Json<Map<String, Value>>,
) -> HttpResponse

POST <base>/auth/invitations/{token}/accept — take the invitation up.

Two shapes, decided by whether the address already has an account:

• No account — the body carries password (plus whatever else the user model asks a new person for) and the account is created here. It is marked as having a confirmed address without a second email: opening this link is the proof that a confirmation email would have been asking for.
• An account exists — nothing is created and no password is wanted. The token proves control of the address the account is registered to, which is the same thing a login proves.

Either way the membership is created, the invitation is stamped as accepted rather than deleted (so “who let them in” survives), and a session token comes back — nobody should have to sign in immediately after proving who they are.