Release v2.6.0

Summary

Makes AuthProxy the authoritative invite-token validator across both phases of the invite flow and binds an invitation to its intended recipient. Previously the signed invite token was validated only at the magic-link entry (Phase 1) and then forwarded verbatim from the HTTP-only .cratis-invite cookie to the exchange endpoint (Phase 2) without re-validation, and nothing bound the invited email to the authenticating account — so a logged-in caller could present a self-crafted token, or accept an invitation with a different account, and be provisioned as the invited user.

Added

• Invite.EmailClaim configuration (default email) naming the invite-token claim that carries the email an invitation was issued for. Set it to an empty string to disable email-binding enforcement.
• invitation-email-mismatch.html well-known page, served (HTTP 403) when the signed-in account's verified email does not match the invited email.

Changed

• The Phase-2 invite exchange request now forwards the authenticating account's provider-verified email and its verification status, so the backend can apply its own defense-in-depth check of invited-email vs. authenticated-email at accept time.

Security

• Re-validate the invite token (RSA signature, issuer, audience, and lifetime) at the Phase-2 exchange forward and refuse to forward when it fails. HTTP-only cookies only block browser JavaScript, so an authenticated caller could otherwise hand a self-crafted token to the exchange endpoint.
• Bind an invitation to its recipient: when the invite token targets a specific email, require the authenticating account's verified email to match (respecting email_verified) and reject on mismatch, so an invitation can no longer be redeemed with a different account.