Security hardening: invited user onboarding flow (C1–N7)

app/login/verify.php

@@ -15,10 +15,13 @@
     }
 
     // ── Look up token ─────────────────────────────────────────────
+    // license='owner' guard: invited users also have verify_token set, but they
+    // must use invited_onboarding.php — never this flow.
     $sth = $pdo1->prepare("
         SELECT user_id, name, status, verify_expires_at
         FROM user
         WHERE verify_token = :token
+          AND license      = 'owner'
         LIMIT 1
     ");
     $sth->execute([':token' => $token]);