Release 0.16.0: owner-only invite for per-RFC contribution + discussion (+ #21 Part C Amplitude wiring)

Wave 5 / Track B. Roadmap item #12. Folds in #21 Part C Amplitude
wiring inline (operator ask: "best practices from the very get-go").

RFC owners can invite specific users to one of two per-RFC roles:
contributor (open PRs + join discussion) or discussant (discussion
only). Non-invited users keep the v0.6.0 anonymous-read contract.
The per-RFC write gate layers on top of the existing
require_contributor gate; a super-draft with no owners yet falls
through to the platform-granted contract, preserving the
v0.6.0/v0.7.0/v0.8.0 contracts in their domains.

Backend: migration 018_rfc_invitations.sql (auto-applied — two
tables: rfc_invitations + rfc_collaborators); api_invitations.py
with five endpoints + transactional email; auth.py helpers
(is_rfc_owner / is_rfc_collaborator / can_discuss_rfc /
can_contribute_to_rfc / can_invite_to_rfc); api_discussion +
api_branches + api_prs gate composition; api_admin.py additive
rfc_invitations[] per user. 237 backend tests pass (18 new in
test_rfc_invitations_vertical.py).

Frontend: InvitationsModal.jsx (owner surface), AcceptInvitation.jsx
(/invitations/accept route), api.js helpers, RFCView.jsx
Invitations button, App.jsx route registration.

Amplitude wiring (inline, #21 Part C):
  - INVITATION_SENT from InvitationsModal { rfc_slug, role_in_rfc }
  - INVITATION_ACCEPTED from AcceptInvitation { rfc_slug, role_in_rfc }
  - identify() BEFORE the accept event with properties: invited_at
    (setOnce), last_invited_to_rfc, last_invite_role_in_rfc,
    claim_method: 'rfc-invite'
  - EVENTS taxonomy extended with INVITATION_SENT + INVITATION_ACCEPTED

No new secrets, no new overlay keys, no operator gesture beyond the
v0.15.0 overlay-set + restart. Frontend build verified green.

Subagent ν shipped the feature on feature/v0.16.0-owner-invite
(a51beec). Driver-side integration squash-merged into main,
hand-resolved VERSION + package.json + CHANGELOG (strict-descending
0.16.0 → 0.15.0), and added the inline Amplitude wiring.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/tests/test_pr_flow_vertical.py

@@ -21,6 +21,7 @@ import pytest
 from test_propose_vertical import (  # noqa: F401
     FakeGitea,
     app_with_fake_gitea,
+    grant_rfc_collaborator,
     provision_user_row,
     sign_in_as,
     tmp_env,
@@ -140,6 +141,9 @@ def test_get_pr_returns_three_column_payload(app_with_fake_gitea):
         provision_user_row(user_id=3, login="bob", role="contributor")
         seed_active_rfc(fake, slug="ohm", title="OHM", body=SEED_BODY)
         # Bob is the non-arbiter contributor — alice is seeded as an RFC owner.
+        # v0.16.0 (item #12): bob needs an accepted per-RFC contributor
+        # invitation to cut branches and open PRs on alice's RFC.
+        grant_rfc_collaborator(user_id=3, rfc_slug="ohm", role_in_rfc="contributor")
         sign_in_as(client, user_id=3, gitea_login="bob", display_name="Bob", role="contributor")
         branch, _ = _cut_branch_and_accept_change(
             client, fake, slug="ohm",
@@ -292,6 +296,9 @@ def test_merge_by_arbiter_advances_main_and_marks_pr_merged(app_with_fake_gitea)
         provision_user_row(user_id=1, login="ben", role="owner")
         seed_active_rfc(fake, slug="ohm", title="OHM", body=SEED_BODY)
         # Bob is neither owner nor arbiter — the non-merge baseline.
+        # v0.16.0 (item #12): bob still needs an accepted contributor
+        # invitation to cut the branch + open the PR.
+        grant_rfc_collaborator(user_id=3, rfc_slug="ohm", role_in_rfc="contributor")
         sign_in_as(client, user_id=3, gitea_login="bob", display_name="Bob", role="contributor")
         branch, _ = _cut_branch_and_accept_change(
             client, fake, slug="ohm",
@@ -364,6 +371,10 @@ def test_resolution_branch_replays_clean_and_supersedes_on_merge(app_with_fake_g
         provision_user_row(user_id=3, login="bob", role="contributor")
         provision_user_row(user_id=1, login="ben", role="owner")
         seed_active_rfc(fake, slug="ohm", title="OHM", body=SEED_BODY)
+        # v0.16.0 (item #12): bob (a non-owner contributor) needs an
+        # accepted per-RFC invitation to cut a branch on alice's RFC.
+        # Alice is the seeded RFC owner so she doesn't need one.
+        grant_rfc_collaborator(user_id=3, rfc_slug="ohm", role_in_rfc="contributor")
 
         # Alice cuts a branch and accepts a change on it.
         sign_in_as(client, user_id=2, gitea_login="alice", display_name="Alice", role="contributor")