Release v2.17.2

Fixed

• An invitation is now completed only with the identity that authenticated for that invitation. A session the browser was already carrying — from an earlier sign-in, possibly with a different provider — no longer completes a pending invitation, so an organization can no longer be bound permanently to an account the person did not choose for it.
• A caller who is already signed in and opens an invitation link is now always shown the invitation provider-selection page, including where only a single identity provider is configured, and the invitation completes with the identity that comes back from the provider they pick.
• A pending invitation is left in place when it cannot yet be completed, so it stays valid for the lifetime of the .cratis-invite cookie instead of being consumed by the wrong session.
• Invite-token re-validation at the post-login exchange is unchanged: a forged, expired, or otherwise invalid capability is still refused with invitation-invalid.html / invitation-expired.html and cleared from the browser before anything else is decided.