Security hardening: invited user onboarding flow (C1–N7)

- C1: verify.php now filters license='owner' — invite tokens no longer accepted
- C1: onboarding API rejects non-owner sessions
- C2: Existing-user invite requires explicit acceptance via accept_invite.php
- C2: New accept_invite.php page and API engine added
- C2: inviteUser() generates token + expiry for existing users; resendInvite() handles active users
- C3: session_regenerate_id(true) before writing invite session keys on both invite pages
- C4: invited_onboarding API wraps activation in transaction with SELECT FOR UPDATE; rowCount check added; SQLSTATE 23000 caught cleanly
- C5: inviteUser() and resendInvite() two-table writes wrapped in transactions
- M2: removeUser() wrapped in transaction with FOR UPDATE; clears default_company on active user removal
- M4: Logged-in user guard added to invited_onboarding.php and accept_invite.php
- M5: manage_users.php uses $server_url instead of HTTP_HOST for invite URLs
- M6: Username regex enforces 3-32 chars; reserved name blocklist added
- N5: searchUsers() changed from LIKE fuzzy search to exact email match only
- N7: resendInvite() rate-limited to once per 60s via invite_resent_at column
- Schema: company_map_user gains invite_expires_at and invite_resent_at columns

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/login/api/engine/onboarding.php

@@ -68,6 +68,17 @@ if (empty($_SESSION['onboarding_user_id'])) {
 
 $user_id = (int)$_SESSION['onboarding_user_id'];
 
+// ── Step 1b: License guard ────────────────────────────────────────────────────
+// Invited users (license='user') must use invited_onboarding.php, not this flow.
+// If somehow an invited user's session reaches here, reject immediately.
+$sth = $pdo1->prepare("SELECT license FROM user WHERE user_id = :uid LIMIT 1");
+$sth->execute([':uid' => $user_id]);
+if ($sth->fetchColumn() !== 'owner') {
+    $answer['message'] = 'Invalid session.';
+    http_response_code(403);
+    exit(json_encode($answer));
+}
+
 // ── Step 2: CSRF check ────────────────────────────────────────────────────────
 if ($_SERVER['REQUEST_METHOD'] === 'POST') {
     $csrf = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';