Add access invitation policy auditor

[Davidrsdiaz]

/claim #11

Summary

• add a deterministic invitation and object-level access policy auditor for User & Project Management
• detect expired active invitations, role escalation without owner approval, restricted dataset download bypasses, institutional-domain mismatches, unverified elevated roles, anonymous private access, audit-log gaps, missing download deny rules, and stale external collaborators
• include synthetic JSON, Markdown, SVG, and short MP4 demo artifacts

Tests

• node user-project-management/access-invitation-policy-auditor/test.js
• node user-project-management/access-invitation-policy-auditor/demo.js
• node user-project-management/access-invitation-policy-auditor/make-demo-video.js

All fixtures are synthetic and the module performs no account, identity-provider, private project, credential, SAML, ORCID, or external API access.