fix: presigned URL signatures, bucket consolidation, login & invite status

- MinIO: use separate public client for presigned URLs so AWS V4 signature
  matches the browser's Host header (fixes SignatureDoesNotMatch on all uploads)
- Consolidate applicant/partner uploads to mopc-files bucket (removes
  non-existent mopc-submissions and mopc-partners buckets)
- Auth: allow magic links for any non-SUSPENDED user (was ACTIVE-only,
  blocking first-time CSV-seeded applicants)
- Auth: accept invite tokens for any non-SUSPENDED user (was INVITED-only)
- Ensure all 14 invite token locations set status to INVITED

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/server/routers/user.ts

@@ -879,6 +879,7 @@ export const userRouter = router({
               data: {
                 inviteToken: token,
                 inviteTokenExpiresAt: new Date(Date.now() + expiryMs),
+                status: 'INVITED',
               },
             })