v0.29.0: #28 Parts 2+3 — create-RFC offers + contribute-to-pending requests

Extends the v0.26.0 (#28 Part 1) read-time scanner into three buckets in
one pass — active link (Part 1), pending-RFC contribute offer (Part 3),
create-RFC offer (Part 2) — precedence active > pending > candidate. The
backend still emits only structured segments (never HTML), so the surface
stays XSS-safe by construction.

Part 2 — create-RFC offers: a multi-word tag from the #27 taxonomy with no
defining RFC renders, for a create-rights viewer, as an inline "+ create
RFC" affordance that opens the propose modal pre-filled (?propose=<term>;
ProposeModal gained initialTitle). Conservative multi-word gate; broader
heuristics + the Haiku path are deferred.

Part 3 — contribute-to-pending offers: a term matching a super-draft
renders, for a signed-in non-owner, an "ask to contribute" affordance with
the owner's display name. It opens a 3-field request form (who/why/optional
use-case); submitting lands a contribution_requests row (migration 024) and
one actionable §15 notification per owner (new kind
contribution_request_on_pending_rfc, personal-direct). The owner's inbox
shows who/why/use-case inline with Accept/Decline. Accept fires #12's
owner-invite flow with the requester as invitee and echoes a notification
back; decline notifies the requester. Pre-merge idea PRs are out of scope.

New endpoints: GET /api/rfcs/{slug}/contribution-target,
POST /api/rfcs/{slug}/contribution-requests,
.../{id}/accept, .../{id}/decline. The invite issue path was refactored
into one reusable api_invitations.issue_invitation(...) chokepoint shared
by the manual invite endpoint and Part 3's accept.

Tests: 9 new (3 scanner-bucket unit + 6 e2e). Full suite 374 passing.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

backend/app/api_invitations.py

@@ -133,69 +133,15 @@ def make_router() -> APIRouter:
                 "Only the RFC's owner can invite collaborators",
             )
 
-        invitee_email = body.invitee_email.strip()
-        role_in_rfc = body.role_in_rfc
-
-        # Refuse re-inviting an email that already has a pending
-        # invitation on this RFC at the same role. Different-role
-        # re-invite is allowed (upgrade discussant → contributor)
-        # — the new row supersedes the old in the UI listing's
-        # natural ordering, and acceptance of either picks up the
-        # corresponding role.
-        existing = db.conn().execute(
-            """
-            SELECT id FROM rfc_invitations
-             WHERE rfc_slug = ? AND invitee_email = ? COLLATE NOCASE
-               AND role_in_rfc = ? AND status = 'pending'
-             LIMIT 1
-            """,
-            (slug, invitee_email, role_in_rfc),
-        ).fetchone()
-        if existing:
-            raise HTTPException(
-                409,
-                f"{invitee_email} already has a pending {role_in_rfc} invitation for this RFC",
-            )
-
-        token = _mint_token()
-        cur = db.conn().execute(
-            """
-            INSERT INTO rfc_invitations
-                (rfc_slug, inviter_user_id, invitee_email, role_in_rfc,
-                 token, expires_at)
-            VALUES (?, ?, ?, ?, ?, datetime('now', ?))
-            """,
-            (
-                slug,
-                viewer.user_id,
-                invitee_email,
-                role_in_rfc,
-                token,
-                f"+{INVITATION_TTL_DAYS} days",
-            ),
-        )
-        invitation_id = cur.lastrowid
-
-        # Send the email — synchronous. A send failure logs and
-        # returns; the row stays so the owner can recover via the
-        # listing (which carries the token for an out-of-band share).
-        _send_invitation_email(
-            to_address=invitee_email,
+        return issue_invitation(
+            slug=slug,
+            inviter_user_id=viewer.user_id,
             inviter_display=viewer.display_name or viewer.gitea_login or "An RFC owner",
+            invitee_email=body.invitee_email,
+            role_in_rfc=body.role_in_rfc,
             rfc_title=rfc["title"],
-            role_in_rfc=role_in_rfc,
-            token=token,
         )
 
-        return {
-            "id": invitation_id,
-            "rfc_slug": slug,
-            "invitee_email": invitee_email,
-            "role_in_rfc": role_in_rfc,
-            "status": "pending",
-            "token": token,
-        }
-
     # ---------------------------------------------------------------
     # GET /api/rfcs/<slug>/invitations
     # The owner's listing of every invitation on the RFC, regardless
@@ -473,6 +419,78 @@ def _effective_status(row) -> str:
     return "expired" if is_past else "pending"
 
 
+def issue_invitation(
+    *,
+    slug: str,
+    inviter_user_id: int,
+    inviter_display: str,
+    invitee_email: str,
+    role_in_rfc: str,
+    rfc_title: str,
+) -> dict:
+    """Mint + persist + email one ``rfc_invitations`` row.
+
+    The single chokepoint for issuing an invitation: the owner's manual
+    `POST /api/rfcs/{slug}/invitations` endpoint and roadmap #28 Part 3's
+    accept path both route through here, so the dup-guard, token mint,
+    insert, and transactional email stay identical.
+
+    Refuses (409) re-inviting an email that already has a pending
+    invitation on this RFC at the same role. A different-role re-invite is
+    allowed (the discussant → contributor upgrade) — the new row
+    supersedes the old in the listing's natural ordering, and acceptance
+    of either picks up the corresponding role.
+
+    Returns the new row's dict (including the raw token, for the owner's
+    out-of-band share / the caller's record-keeping). A send failure logs
+    and returns; the row stays so the owner can recover via the listing.
+    """
+    invitee_email = invitee_email.strip()
+    existing = db.conn().execute(
+        """
+        SELECT id FROM rfc_invitations
+         WHERE rfc_slug = ? AND invitee_email = ? COLLATE NOCASE
+           AND role_in_rfc = ? AND status = 'pending'
+         LIMIT 1
+        """,
+        (slug, invitee_email, role_in_rfc),
+    ).fetchone()
+    if existing:
+        raise HTTPException(
+            409,
+            f"{invitee_email} already has a pending {role_in_rfc} invitation for this RFC",
+        )
+
+    token = _mint_token()
+    cur = db.conn().execute(
+        """
+        INSERT INTO rfc_invitations
+            (rfc_slug, inviter_user_id, invitee_email, role_in_rfc,
+             token, expires_at)
+        VALUES (?, ?, ?, ?, ?, datetime('now', ?))
+        """,
+        (slug, inviter_user_id, invitee_email, role_in_rfc, token, f"+{INVITATION_TTL_DAYS} days"),
+    )
+    invitation_id = cur.lastrowid
+
+    _send_invitation_email(
+        to_address=invitee_email,
+        inviter_display=inviter_display,
+        rfc_title=rfc_title,
+        role_in_rfc=role_in_rfc,
+        token=token,
+    )
+
+    return {
+        "id": invitation_id,
+        "rfc_slug": slug,
+        "invitee_email": invitee_email,
+        "role_in_rfc": role_in_rfc,
+        "status": "pending",
+        "token": token,
+    }
+
+
 def _mint_token() -> str:
     """A 256-bit URL-safe token. The token shape is opaque to the
     consumer; the email link encodes it as a query param."""