Sign-in via django-allauth: emailed one-time codes, GitHub, Discord,
and Forgejo instances as OpenID Connect apps registered in admin.
Regular users never have a password; sysadmins sign in only at
/admin/ and are redirected there from the normal sign-in.
Organizations at the URL root with owner and collaborator roles, a
per-member project-create grant, and invites by username or email.
Email invites carry a bearer token stored only as a hash. The last
owner can't leave, be removed or be demoted. Permission checks live
in intent/access.py.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
