fix(auth): longer IDs and invite codes, register limits, single-use invites (FLAW-32, FLAW-39, FLAW-40)

- NewID uses 96 random bits; invite codes get their own 100 bits in Base32.
- Registration and forgot-password are limited per address via loginGuard.
- The invite is claimed atomically before the account is created and
  released again when the account cannot be created.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/domain/models.go

@@ -10,9 +10,10 @@ import (
 	"time"
 )
 
-// NewID generates a readable prefixed ID as specified in BRAIN.md (e.g. th_4x8z19a0b1)
+// NewID generates a readable prefixed ID (e.g. th_4f1c09e2b7a35d68c0e1f2a3). 96 random bits keep
+// collisions out of reach; older IDs with 40 bits stay valid (FLAW-32).
 func NewID(prefix string) string {
-	b := make([]byte, 5)
+	b := make([]byte, 12)
 	_, _ = rand.Read(b)
 	return fmt.Sprintf("%s_%s", prefix, hex.EncodeToString(b))
 }