Settings → Accounts is no longer read-only.

Org owners can now:

• Send invitations by email — generates a one-time accept URL valid for 14 days
• Pick the role at invite time (Member or Admin)
• Change roles for existing members
• Remove members (with a confirm step so it's not a single-click foot-gun)
• Revoke pending invitations before they're used

Invitees land on /invite/<token> — sign in with the matching email, click "Accept invitation", and they're in. Email mismatch is caught server-side via a security-definer function so an invite can't be claimed by someone else.