1.9.0 — invite, revoke, change email, delete

The operator can invite. The table says whether it is still free.

Invite, revoke, change email, delete — and the people pane (#232, ADR-008 §3, §4, §8,
§11, §12). The third of multi-user's five, and the one that makes an invitation possible.

Added

• A hosting › people row in the sheet, for the operator only: a plain DM Mono table
  with one row per person — last seen, devices, pages, sittings, the agent's share, wipes
  and items done over thirty days — a totals row, and a N of 25 headline.
  No page content, ever.
• Invite is an address and a button. The mail is the first login mail with invite
  framing and a seven-day link and no code — a code is bound to the browser that asked
  for it, and that browser was the operator's.
• Revoke keeps their pages and ends every session and OAuth grant on the next request.
  Delete removes every row they own. Change email is the only recovery lever there
  is: tap the address, and a fresh invite goes to the new one — identity is the row, so
  the pages stay. Revoke and delete confirm by a second tap on the same control, never by
  a dialog.
• MAX_USERS = 25 is a tripwire in the code, the way the nine-page cap is; a revoke frees
  a place.
• The routes: GET /api/me; GET, POST /api/users; PATCH, DELETE /api/users/<id>
  (?hard to delete). Session or bearer. A member gets the 404 a missing route gets —
  same body, same status — so the surface is invisible to anyone it is not for. The
  operator can never be removed, by id or by self.
• sessions.last_seen_at (migration 0012, additive), written only when more than an hour
  stale, so a 4-second poll never becomes a write per request.
• A design brief for the pane, docs/design/admin-view-brief.md. It ships plain; the
  ruling comes after.

Changed

• settings is no longer written (#234, release two of three). 1.7.0 mirrored the
  operator's agent instructions into the legacy table so a rollback would still read
  current text; this release removes that write and carries no migration touching it. The
  release after this drops the table — and this one has to be live first, or the drop
  lands under a Worker still writing to it (ADR-002 §3).

Full changelog: v1.8.0...v1.9.0