Fix S3/SMTP connectivity and add one-click invite flow

- Fix MinIO port parsing bug: use protocol-appropriate defaults (443/80)
  instead of hardcoded 9000 fallback, enabling public URL endpoint
- Remove unused SMTP server config from NextAuth EmailProvider to prevent
  connection errors (sendVerificationRequest is fully overridden)
- Replace extra_hosts with DNS config (8.8.8.8) so container resolves
  mail.monaco-opc.com to public IP instead of host loopback
- Add invite token auth: single-click accept-invite flow replacing broken
  two-email invitation process
- Auto-send invitation emails on bulk user creation
- Update email template expiry text from 24 hours to 7 days

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

docker/.env.production

@@ -21,12 +21,13 @@ NEXTAUTH_SECRET=CHANGE_ME_use_openssl_rand
 # =============================================================================
 # FILE STORAGE (MinIO - external stack)
 # =============================================================================
-# Internal endpoint (server-to-server, within Docker host)
-MINIO_ENDPOINT=http://localhost:9000
+# Use the public URL — nginx proxies to MinIO internally.
+# The port parsing handles standard ports (443 for HTTPS, 80 for HTTP) automatically.
+MINIO_ENDPOINT=https://s3.monaco-opc.com
 
-# Public endpoint for browser-accessible pre-signed URLs
-# Set this when MinIO is behind a reverse proxy
-# MINIO_PUBLIC_ENDPOINT=https://storage.monaco-opc.com
+# MINIO_PUBLIC_ENDPOINT is only needed if the internal endpoint differs from the public one.
+# When using the public URL as MINIO_ENDPOINT, leave this empty or omit it.
+# MINIO_PUBLIC_ENDPOINT=
 
 MINIO_ACCESS_KEY=CHANGE_ME
 MINIO_SECRET_KEY=CHANGE_ME