M2a: server workspace, kvitt-domain, skeleton routes, OpenAPI match, Dockerfile

Cargo workspace (kvitt-domain, kvitt-server, kvitt-import), Rust 1.99.1 pinned.
kvitt-domain passes every Rust vector and adds next_occurrence_date (D-015).
kvitt-server: config, SQLite pool (WAL, §8.9 pragmas), migration 0001 identical to
the contract schema, error type for all 25 codes, auth extractor and protocol
layer, all 33 routes (E-1/E-2 implemented, the rest 501), utoipa document equal
to contracts/openapi.yaml, seams for M3/M4/M9, serve/migrate/healthcheck.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/crates/kvitt-server/src/wire/invite.rs

@@ -0,0 +1,80 @@
+//! Invite objects (SPEC §14.3.3, §14.3.4 E-3, E-12, E-13).
+
+use serde::{Deserialize, Serialize};
+use utoipa::ToSchema;
+use uuid::Uuid;
+
+use super::device::Device;
+use super::user::User;
+use super::{TimestampSchema, UuidSchema};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, ToSchema)]
+#[serde(rename_all = "snake_case")]
+pub enum InviteKind {
+    AdminSetup,
+    Partner,
+    Device,
+}
+
+/// `code` and `link` only in the `POST /invites` response; `null` in `GET /invites`.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, ToSchema)]
+pub struct Invite {
+    #[schema(value_type = UuidSchema)]
+    pub id: Uuid,
+    pub kind: InviteKind,
+    #[schema(value_type = Option<UuidSchema>, required = true)]
+    pub target_user_id: Option<Uuid>,
+    #[schema(required = true)]
+    pub code: Option<String>,
+    #[schema(required = true)]
+    pub link: Option<String>,
+    #[schema(value_type = TimestampSchema)]
+    pub created_at: String,
+    #[schema(value_type = TimestampSchema)]
+    pub expires_at: String,
+}
+
+/// E-13 `GET /invites`.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, ToSchema)]
+pub struct InviteList {
+    pub invites: Vec<Invite>,
+}
+
+/// E-3 `POST /invites/accept`. `display_name` is required for `admin_setup` and `partner` invites
+/// (`invalid_request` if missing) and ignored for `device`.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, ToSchema)]
+pub struct AcceptInviteRequest {
+    pub code: String,
+    pub device_name: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[schema(value_type = String)]
+    pub display_name: Option<String>,
+}
+
+/// E-3 response. The token is shown only here.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, ToSchema)]
+pub struct AcceptInviteResponse {
+    pub token: String,
+    pub user: User,
+    pub device: Device,
+    pub household: Vec<User>,
+}
+
+/// The kinds an admin may create (E-12).
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, ToSchema)]
+#[serde(rename_all = "snake_case")]
+pub enum CreateInviteKind {
+    Partner,
+    Device,
+}
+
+/// E-12 `POST /invites`. `target_user_id` is optional and nullable (absent = null); required for `device`, must be
+/// null for `partner`.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, ToSchema)]
+pub struct CreateInviteRequest {
+    #[schema(inline)]
+    pub kind: CreateInviteKind,
+    #[serde(default)]
+    #[schema(value_type = Option<UuidSchema>)]
+    pub target_user_id: Option<Uuid>,
+}