feat(core): Wave 3.5 邀请制后端 — Invitation 模型 + 端点 + register 改造(只生成迁移不apply)

- Invitation 模型:team/code(TEAM-XXXX-XXXX唯一)/role/email/月额度/created_by/expires_at(7天)/
  used_by/used_at/status(pending/used/revoked/expired);迁移 accounts/0003(未 apply 远程库,rule 3)
- RegisterSerializer 加 invite_code:有效码→幂等 get_or_create 成员+标used+跳过额度发放;
  无码→开新团队当 owner+试用额度(原逻辑);邀请 role 不许 OWNER 降级 ADMIN;不存在/已用/过期→400
- 端点 /api/auth/team/invitations/(GET列/POST生成)+ <id>/revoke/;权限复用 can_manage_team(超管/团管)

验证: django check 0;apps.accounts 测试 5/5 OK —— 含「凭码加入同团队/角色额度对/不重复发额度/
  未知码400/普通成员生成403」。认证定调:username 为主标识、不用邮箱注册。

⚠️ Invitation 迁移需用户低峰 apply 到远程 MySQL,前端生成码 e2e 才能跑(逻辑已被测试证)。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

core/backend/apps/accounts/models.py

@@ -95,3 +95,53 @@ class TeamMember(TimeStampedModel):
 
     def __str__(self) -> str:
         return f"{self.team} / {self.user} / {self.role}"
+
+
+def _gen_invite_code() -> str:
+    import secrets
+    import string
+
+    alphabet = "".join(c for c in (string.ascii_uppercase + string.digits) if c not in "O0I1")
+    block = lambda: "".join(secrets.choice(alphabet) for _ in range(4))  # noqa: E731
+    return f"TEAM-{block()}-{block()}"
+
+
+def _default_invite_expiry():
+    from datetime import timedelta
+
+    from django.utils import timezone
+
+    return timezone.now() + timedelta(days=7)
+
+
+class Invitation(TimeStampedModel):
+    """团队邀请码:超管/团管生成,新用户凭码注册即加入该团队(幂等加成员、不重复发额度)。"""
+
+    class Status(models.TextChoices):
+        PENDING = "pending", "Pending"
+        USED = "used", "Used"
+        REVOKED = "revoked", "Revoked"
+        EXPIRED = "expired", "Expired"
+
+    team = models.ForeignKey(Team, on_delete=models.CASCADE, related_name="invitations")
+    code = models.CharField(max_length=32, unique=True, default=_gen_invite_code)
+    role = models.CharField(max_length=24, choices=TeamMember.Role.choices, default=TeamMember.Role.MEMBER)
+    email = models.EmailField(blank=True)
+    monthly_credit_limit = models.DecimalField(max_digits=12, decimal_places=2, default=0)
+    created_by = models.ForeignKey(User, on_delete=models.SET_NULL, null=True, blank=True, related_name="created_invitations")
+    expires_at = models.DateTimeField(default=_default_invite_expiry)
+    used_by = models.ForeignKey(User, on_delete=models.SET_NULL, null=True, blank=True, related_name="used_invitations")
+    used_at = models.DateTimeField(null=True, blank=True)
+    status = models.CharField(max_length=16, choices=Status.choices, default=Status.PENDING)
+
+    class Meta:
+        indexes = [models.Index(fields=["team", "status"])]
+
+    @property
+    def is_valid(self) -> bool:
+        from django.utils import timezone
+
+        return self.status == self.Status.PENDING and self.expires_at > timezone.now()
+
+    def __str__(self) -> str:
+        return f"{self.team} / {self.code} / {self.status}"